better-supabase 0.5.0 → 0.6.0

package/schemas/config-v1.json

@@ -6,7 +6,9 @@
   "type": "object",
   "additionalProperties": false,
   "properties": {
-    "$schema": { "type": "string" },
+    "$schema": {
+      "type": "string"
+    },
     "source": {
       "description": "Where codegen reads the database from. Without any of these, $DATABASE_URL and then the local stack are used.",
       "type": "object",
@@ -33,21 +35,43 @@
     "schemas": {
       "description": "Postgres schemas to generate.",
       "type": "array",
-      "items": { "type": "string" },
+      "items": {
+        "type": "string"
+      },
       "default": ["public"]
     },
-    "casing": { "$ref": "#/$defs/casing", "default": "snake" },
+    "casing": {
+      "$ref": "#/$defs/casing",
+      "default": "snake"
+    },
     "tables": {
       "type": "object",
       "additionalProperties": {
         "type": "object",
         "additionalProperties": false,
         "properties": {
-          "casing": { "$ref": "#/$defs/casing" },
-          "exclude": { "type": "boolean" },
+          "casing": {
+            "$ref": "#/$defs/casing"
+          },
+          "exclude": {
+            "type": "boolean"
+          },
+          "serviceRole": {
+            "type": "boolean",
+            "description": "Only service_role reaches the table. Models are still generated; doctor (BS106) checks that anon and authenticated have no grants."
+          },
           "relations": {
             "type": "object",
-            "additionalProperties": { "type": "string" }
+            "additionalProperties": {
+              "type": "string"
+            }
+          },
+          "insertOptional": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Database names of not-null columns an insert may leave out because the database fills them, for example from a before insert trigger."
           }
         }
       }
@@ -67,9 +91,30 @@
       "type": "object",
       "additionalProperties": false,
       "properties": {
-        "timestamptz": { "enum": ["string", "instant"], "default": "string" },
-        "int8": { "enum": ["number", "string", "bigint"], "default": "number" },
-        "numeric": { "enum": ["number", "string"], "default": "number" }
+        "timestamptz": {
+          "enum": ["string", "instant"],
+          "default": "string"
+        },
+        "int8": {
+          "enum": ["number", "string", "bigint"],
+          "default": "number"
+        },
+        "numeric": {
+          "enum": ["number", "string"],
+          "default": "number"
+        }
+      }
+    },
+    "relations": {
+      "description": "How generated relations are typed.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "nullableUnderRls": {
+          "type": "boolean",
+          "description": "Type to-one includes of tables with row level security as nullable, since a policy can hide the related row.",
+          "default": false
+        }
       }
     },
     "json": {
@@ -120,48 +165,70 @@
       "properties": {
         "timestamps": {
           "oneOf": [
-            { "type": "boolean" },
+            {
+              "type": "boolean"
+            },
             {
               "type": "object",
               "additionalProperties": false,
               "properties": {
-                "createdAt": { "type": "string" },
-                "updatedAt": { "type": "string" }
+                "createdAt": {
+                  "type": "string"
+                },
+                "updatedAt": {
+                  "type": "string"
+                }
               }
             }
           ]
         },
         "softDelete": {
           "oneOf": [
-            { "type": "boolean" },
+            {
+              "type": "boolean"
+            },
             {
               "type": "object",
               "additionalProperties": false,
-              "properties": { "column": { "type": "string" } }
+              "properties": {
+                "column": {
+                  "type": "string"
+                }
+              }
             }
           ]
         },
         "tenant": {
           "oneOf": [
-            { "type": "boolean" },
+            {
+              "type": "boolean"
+            },
             {
               "type": "object",
               "additionalProperties": false,
               "properties": {
-                "column": { "type": "string" }
+                "column": {
+                  "type": "string"
+                }
               }
             }
           ]
         },
         "actor": {
           "oneOf": [
-            { "type": "boolean" },
+            {
+              "type": "boolean"
+            },
             {
               "type": "object",
               "additionalProperties": false,
               "properties": {
-                "createdBy": { "type": "string" },
-                "updatedBy": { "type": "string" }
+                "createdBy": {
+                  "type": "string"
+                },
+                "updatedBy": {
+                  "type": "string"
+                }
               }
             }
           ]
@@ -169,7 +236,7 @@
       }
     },
     "claims": {
-      "description": "Claim names shared by the SQL kit, codegen and runtime defaults (PermDock's claim contract).",
+      "description": "Claim names shared by the SQL modules, codegen and runtime defaults.",
       "type": "object",
       "additionalProperties": false,
       "properties": {
@@ -184,6 +251,10 @@
         "features": {
           "type": "string",
           "description": "Claim holding plan features per tenant. Defaults to `features`."
+        },
+        "memberships": {
+          "type": "string",
+          "description": "Claim the memberships hook writes. Defaults to `memberships`."
         }
       }
     },
@@ -194,83 +265,225 @@
         "required": ["path"],
         "additionalProperties": false,
         "properties": {
-          "id": { "type": "string" },
-          "public": { "type": "boolean" },
+          "id": {
+            "type": "string"
+          },
+          "public": {
+            "type": "boolean"
+          },
           "path": {
-            "type": "string",
-            "description": "Path template, e.g. `{orgId}/{customerId}/logo.webp`."
+            "description": "Path template, e.g. `{organizationId}/{customerId}/logo.webp`, or several for a bucket that stores objects in more than one layout. A last segment `{...rest}` matches one or more segments.",
+            "oneOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                },
+                "minItems": 1
+              }
+            ]
           },
           "policy": {
             "oneOf": [
-              { "enum": ["tenant", "owner", "public", "none"] },
+              {
+                "enum": ["tenant", "owner", "public", "none"]
+              },
               {
                 "type": "object",
-                "description": "Policies that call PermDock's permitted_<scope>_ids or permdock_has helpers.",
-                "required": ["permdock", "scope"],
+                "description": "A policy through the access contract (tenant_ids_with, is_platform), or through `sql` templates such as an authorization provider's.",
+                "required": ["access"],
                 "additionalProperties": false,
                 "properties": {
-                  "permdock": {
+                  "access": {
                     "type": "object",
                     "required": ["read", "write"],
                     "additionalProperties": false,
                     "properties": {
-                      "read": { "type": "string" },
-                      "list": { "type": "string" },
-                      "write": { "type": "string" },
-                      "delete": { "type": "string" }
+                      "read": {
+                        "type": "string"
+                      },
+                      "list": {
+                        "type": "string"
+                      },
+                      "write": {
+                        "type": "string"
+                      },
+                      "delete": {
+                        "type": "string"
+                      }
                     }
                   },
-                  "scope": { "type": "string" },
-                  "segment": { "type": "integer", "minimum": 1 },
-                  "schema": { "type": "string" }
+                  "scope": {
+                    "type": "string",
+                    "description": "`tenant` (default) or `platform`; with `sql`, any scope name the templates take."
+                  },
+                  "segment": {
+                    "type": "integer",
+                    "minimum": 1
+                  },
+                  "sql": {
+                    "description": "SQL templates with `{permission}` and `{scope}` the policy calls instead of the access contract, or `provider` for `authorization.functions`.",
+                    "oneOf": [
+                      {
+                        "const": "provider"
+                      },
+                      {
+                        "type": "object",
+                        "required": ["idsWith", "isPlatform"],
+                        "additionalProperties": false,
+                        "properties": {
+                          "idsWith": {
+                            "type": "string"
+                          },
+                          "isPlatform": {
+                            "type": "string"
+                          }
+                        }
+                      }
+                    ]
+                  }
                 }
               }
             ]
           },
-          "fileSizeLimit": { "type": "string" },
-          "allowedMimeTypes": { "type": "array", "items": { "type": "string" } }
+          "fileSizeLimit": {
+            "type": "string"
+          },
+          "allowedMimeTypes": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "versioning": {
+            "description": "Keep earlier object versions. bucket.apply() sets it.",
+            "type": "boolean"
+          },
+          "lifecycle": {
+            "description": "When noncurrent versions expire. Needs versioning: true.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["rules"],
+            "properties": {
+              "rules": {
+                "type": "array",
+                "minItems": 1,
+                "maxItems": 1000,
+                "items": {
+                  "type": "object",
+                  "additionalProperties": false,
+                  "required": ["noncurrentVersionExpiration"],
+                  "properties": {
+                    "id": {
+                      "type": "string"
+                    },
+                    "status": {
+                      "enum": ["Enabled", "Disabled"]
+                    },
+                    "noncurrentVersionExpiration": {
+                      "type": "object",
+                      "additionalProperties": false,
+                      "required": ["noncurrentDays"],
+                      "properties": {
+                        "noncurrentDays": {
+                          "type": "integer",
+                          "minimum": 1
+                        },
+                        "newerNoncurrentVersions": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 100
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
         }
       }
     },
     "topics": {
       "description": "Realtime topic templates.",
       "type": "object",
-      "additionalProperties": { "type": "string" }
+      "additionalProperties": {
+        "type": "string"
+      }
     },
     "sensitive": {
       "description": "Columns guarded by the noSensitiveSelect rule (`table.column` or `schema.table.column`).",
       "type": "array",
-      "items": { "type": "string" }
+      "items": {
+        "type": "string"
+      }
     },
     "storagePaths": {
       "description": "Text columns holding a storage object path (`table.column` or `schema.table.column`), mapped to a `buckets` key or bucket id. Typed as `StoragePath<'bucket-id'>`.",
       "type": "object",
-      "additionalProperties": { "type": "string" }
+      "additionalProperties": {
+        "type": "string"
+      }
+    },
+    "functions": {
+      "description": "Function results gen may type as not null, keyed by function name. Results are nullable by default.",
+      "type": "object",
+      "additionalProperties": {
+        "type": "object",
+        "additionalProperties": false,
+        "properties": {
+          "notNull": {
+            "description": "true for the whole result, or the returns table columns that are never null.",
+            "oneOf": [
+              {
+                "const": true
+              },
+              {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              }
+            ]
+          }
+        }
+      }
     },
     "expose": {
-      "description": "Data API grants keyed by `table` or `schema.table`: privileges for authenticated, or per role. Written by the `grants` SQL kit module and checked by doctor (BS106).",
+      "description": "Data API grants keyed by `table` or `schema.table`: privileges for authenticated, or per role. Written by the `grants` SQL module and checked by doctor (BS106).",
       "type": "object",
       "additionalProperties": {
         "oneOf": [
-          { "$ref": "#/$defs/privileges" },
+          {
+            "$ref": "#/$defs/privileges"
+          },
           {
             "type": "object",
             "additionalProperties": false,
             "properties": {
-              "anon": { "$ref": "#/$defs/privileges" },
-              "authenticated": { "$ref": "#/$defs/privileges" }
+              "anon": {
+                "$ref": "#/$defs/privileges"
+              },
+              "authenticated": {
+                "$ref": "#/$defs/privileges"
+              }
             }
           }
         ]
       }
     },
     "readSets": {
-      "description": "Modules exporting `defineReadSet` results. `gen` compiles them into the `read-sets` SQL kit module.",
+      "description": "Modules exporting `defineReadSet` results. `gen` compiles them into the `read-sets` SQL module.",
       "type": "array",
-      "items": { "type": "string" }
+      "items": {
+        "type": "string"
+      }
     },
     "entitlements": {
-      "description": "Where the `entitlements` SQL kit module finds each tenant's Stripe customer.",
+      "description": "Where the `entitlements` SQL module finds each tenant's entitlements: a Stripe customer, a plan catalog or your own function.",
       "type": "object",
       "additionalProperties": false,
       "properties": {
@@ -284,17 +497,98 @@
           "type": "string",
           "default": "id"
         },
-        "permdock": {
-          "description": "With a PermDock manifest, read PermDock's memberships for this scope instead of better_supabase.memberships; false keeps the kit's table.",
+        "memberships": {
+          "description": "Where has_entitlement and feature_claims read memberships: \"provider\" (the authorization provider's memberIds functions) or \"tenant\" (better_supabase.memberships). Defaults to \"provider\" when `authorization` is set.",
+          "enum": ["tenant", "provider"]
+        },
+        "source": {
+          "description": "Where each tenant's entitlements come from: \"stripe-sync\" (the Stripe Sync Engine, the default), \"custom\" (your own better_supabase.tenant_entitlements), or a plan catalog in your tables.",
+          "oneOf": [
+            {
+              "enum": ["stripe-sync", "custom"]
+            },
+            {
+              "type": "object",
+              "additionalProperties": false,
+              "required": ["plans"],
+              "properties": {
+                "plans": {
+                  "type": "object",
+                  "additionalProperties": false,
+                  "required": ["subscriptions", "features"],
+                  "properties": {
+                    "subscriptions": {
+                      "type": "object",
+                      "additionalProperties": false,
+                      "required": ["table", "tenant", "plan"],
+                      "properties": {
+                        "table": {
+                          "type": "string"
+                        },
+                        "tenant": {
+                          "type": "string"
+                        },
+                        "plan": {
+                          "type": "string"
+                        },
+                        "status": {
+                          "type": "string"
+                        },
+                        "activeStatuses": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          }
+                        }
+                      }
+                    },
+                    "features": {
+                      "type": "object",
+                      "additionalProperties": false,
+                      "required": ["table", "plan", "feature"],
+                      "properties": {
+                        "table": {
+                          "type": "string"
+                        },
+                        "plan": {
+                          "type": "string"
+                        },
+                        "feature": {
+                          "type": "string"
+                        },
+                        "included": {
+                          "type": "string"
+                        },
+                        "value": {
+                          "type": "string"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          ]
+        },
+        "claim": {
+          "description": "The shape of the features claim feature_claims writes: false for {}, or maxTenants (at most that many tenants) and keys (short codes for feature keys).",
           "oneOf": [
-            { "const": false },
+            {
+              "const": false
+            },
             {
               "type": "object",
               "additionalProperties": false,
               "properties": {
-                "scope": {
-                  "type": "string",
-                  "description": "The PermDock scope tenants are. Defaults to the manifest's root scope, the rls.scopes entry without within."
+                "maxTenants": {
+                  "type": "integer",
+                  "minimum": 1
+                },
+                "keys": {
+                  "type": "object",
+                  "additionalProperties": {
+                    "type": "string"
+                  }
                 }
               }
             }
@@ -302,38 +596,431 @@
         }
       }
     },
-    "permdock": {
-      "description": "Where PermDock's JSON outputs are.",
+    "authorization": {
+      "description": "An authorization provider (apiVersion 1) the SQL modules, policies and doctor delegate to.",
       "type": "object",
       "additionalProperties": false,
+      "required": ["apiVersion", "name", "scopes", "tenantScope", "functions"],
       "properties": {
-        "manifest": {
-          "description": "What `permdock supabase inspect --out` writes.",
-          "type": "string",
-          "default": "permdock.manifest.json"
+        "apiVersion": {
+          "const": 1
+        },
+        "name": {
+          "type": "string"
         },
-        "catalog": {
-          "description": "What `permdock catalog` writes.",
+        "scopes": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["name"],
+            "properties": {
+              "name": {
+                "type": "string",
+                "pattern": "^[a-z][a-z0-9_]*$"
+              },
+              "idType": {
+                "enum": ["uuid", "text", "bigint", "integer"],
+                "description": "Required on the tenant scope."
+              },
+              "parent": {
+                "type": "string"
+              }
+            }
+          }
+        },
+        "tenantScope": {
           "type": "string",
-          "default": "permissions.catalog.json"
+          "pattern": "^[a-z][a-z0-9_]*$"
+        },
+        "functions": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["idsWith", "isPlatform"],
+          "description": "SQL templates with {permission}, {scope}, {user}, {tenant}, {role} and {tool}.",
+          "properties": {
+            "idsWith": {
+              "type": "string"
+            },
+            "isPlatform": {
+              "type": "string"
+            },
+            "idsWithFor": {
+              "type": "string"
+            },
+            "isPlatformFor": {
+              "type": "string"
+            },
+            "memberIds": {
+              "type": "string"
+            },
+            "memberIdsFor": {
+              "type": "string"
+            },
+            "canAssign": {
+              "type": "string"
+            },
+            "canAssignFor": {
+              "type": "string"
+            },
+            "permissionsFor": {
+              "type": "string",
+              "description": "The permission keys {user} holds in {tenant}, as a text[]."
+            },
+            "canApprove": {
+              "type": "string",
+              "description": "Whether the caller may decide the tool call {tool} waits on in {tenant}."
+            }
+          }
+        },
+        "requires": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["function", "role"],
+            "properties": {
+              "function": {
+                "type": "string"
+              },
+              "args": {
+                "type": "string"
+              },
+              "role": {
+                "type": "string"
+              }
+            }
+          }
+        },
+        "permissions": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["key"],
+            "properties": {
+              "key": {
+                "type": "string"
+              },
+              "sqlComplete": {
+                "type": "boolean"
+              },
+              "scopes": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              }
+            }
+          }
+        },
+        "memberships": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["table", "userColumn", "scope", "idColumn"],
+            "properties": {
+              "table": {
+                "type": "string"
+              },
+              "userColumn": {
+                "type": "string"
+              },
+              "idColumn": {
+                "type": "string"
+              },
+              "scope": {
+                "oneOf": [
+                  {
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": ["column"],
+                    "properties": {
+                      "column": {
+                        "type": "string"
+                      }
+                    }
+                  },
+                  {
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": ["value"],
+                    "properties": {
+                      "value": {
+                        "type": "string"
+                      }
+                    }
+                  }
+                ]
+              }
+            }
+          }
+        },
+        "suspension": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "user": {
+              "type": "object",
+              "additionalProperties": false,
+              "required": ["table", "id"],
+              "properties": {
+                "table": {
+                  "type": "string"
+                },
+                "id": {
+                  "type": "string"
+                },
+                "disabledAt": {
+                  "type": "string"
+                },
+                "status": {
+                  "type": "string"
+                },
+                "active": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  }
+                }
+              }
+            },
+            "tenant": {
+              "type": "object",
+              "additionalProperties": false,
+              "required": ["table", "id"],
+              "properties": {
+                "table": {
+                  "type": "string"
+                },
+                "id": {
+                  "type": "string"
+                },
+                "disabledAt": {
+                  "type": "string"
+                },
+                "status": {
+                  "type": "string"
+                },
+                "active": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "roleSources": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["table", "role"],
+            "properties": {
+              "table": {
+                "type": "string"
+              },
+              "role": {
+                "type": "object",
+                "additionalProperties": false,
+                "required": ["column", "through"],
+                "properties": {
+                  "column": {
+                    "type": "string"
+                  },
+                  "through": {
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": ["table", "id", "column"],
+                    "properties": {
+                      "table": {
+                        "type": "string"
+                      },
+                      "id": {
+                        "type": "string"
+                      },
+                      "column": {
+                        "type": "string"
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "decidingColumns": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "description": "`schema.table.column`.",
+            "pattern": "^[A-Za-z_][\\w$]*\\.[A-Za-z_][\\w$]*\\.[A-Za-z_][\\w$]*$"
+          }
+        },
+        "tokenHook": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["function", "ownedClaims"],
+          "properties": {
+            "function": {
+              "type": "string"
+            },
+            "tenantClaim": {
+              "type": "string"
+            },
+            "ownedClaims": {
+              "type": "array",
+              "minItems": 1,
+              "items": {
+                "type": "string"
+              }
+            },
+            "registeredClaims": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "additionalProperties": false,
+                "required": ["name", "function"],
+                "properties": {
+                  "name": {
+                    "type": "string"
+                  },
+                  "function": {
+                    "type": "string"
+                  }
+                }
+              }
+            },
+            "budget": {
+              "type": "object",
+              "additionalProperties": false,
+              "required": ["claims", "bytes"],
+              "properties": {
+                "claims": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "bytes": {
+                  "type": "integer",
+                  "minimum": 1
+                },
+                "truncatedClaim": {
+                  "type": "string"
+                }
+              }
+            },
+            "markers": {
+              "type": "object",
+              "additionalProperties": false,
+              "properties": {
+                "hook": {
+                  "type": "string"
+                },
+                "grants": {
+                  "type": "string"
+                }
+              }
+            },
+            "grantsCommand": {
+              "type": "string"
+            }
+          }
+        },
+        "approvals": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "distinctApprover": {
+              "type": "boolean",
+              "description": "The user who asked for a tool call can't approve it. Default false."
+            }
+          }
+        },
+        "problems": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
         }
       }
     },
     "vectorSearch": {
-      "description": "Embedding columns keyed by `table` or `schema.table`. The `vector-search` SQL kit module writes `search_<table>(query, k)` for each.",
+      "description": "Embedding columns keyed by `table` or `schema.table`. The `vector-search` SQL module writes `search_<table>(query, k)` for each.",
       "type": "object",
       "additionalProperties": {
         "oneOf": [
-          { "type": "string", "description": "The embedding column." },
+          {
+            "type": "string",
+            "description": "The embedding column."
+          },
           {
             "type": "object",
             "additionalProperties": false,
             "required": ["column"],
             "properties": {
-              "column": { "type": "string" },
+              "column": {
+                "type": "string"
+              },
               "distance": {
                 "enum": ["cosine", "l2", "inner_product"],
                 "default": "cosine"
+              },
+              "type": {
+                "enum": ["vector", "halfvec"],
+                "default": "vector"
+              },
+              "key": {
+                "type": "string",
+                "default": "id",
+                "description": "The primary key column db.$search({ score: true }) merges by."
+              },
+              "hybrid": {
+                "type": "object",
+                "additionalProperties": false,
+                "required": ["tsvector"],
+                "description": "Fuses a full-text ranking over a tsvector column with the vector ranking (reciprocal rank fusion).",
+                "properties": {
+                  "tsvector": {
+                    "type": "string"
+                  },
+                  "config": {
+                    "type": "string",
+                    "default": "simple"
+                  },
+                  "k": {
+                    "type": "integer",
+                    "minimum": 1,
+                    "default": 60
+                  }
+                }
+              },
+              "boost": {
+                "type": "string",
+                "description": "A SQL expression over the row t the score is multiplied by."
+              },
+              "prefilter": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                },
+                "description": "Columns db.$search({ filter }) narrows before ranking."
+              },
+              "predicate": {
+                "type": "string",
+                "description": "A SQL condition over the row t every candidate must meet, applied before ranking."
+              },
+              "boostMode": {
+                "enum": ["multiply", "add"],
+                "description": "How boost combines with the score. Defaults to multiply."
+              },
+              "order": {
+                "type": "string",
+                "description": "A SQL order by list over the row t that breaks score ties."
               }
             }
           }
@@ -348,12 +1035,40 @@
         "tables": {
           "description": "Tables that broadcast change signals (`table` or `schema.table`). Install with `better-supabase sql add realtime-tables`.",
           "type": "array",
-          "items": { "type": "string" }
+          "items": {
+            "type": "string"
+          }
         },
         "global": {
           "description": "Tables in `tables` without a tenant column, which broadcast on one topic for every signed-in user.",
           "type": "array",
-          "items": { "type": "string" }
+          "items": {
+            "type": "string"
+          }
+        },
+        "users": {
+          "description": "Tables in `tables` whose rows belong to one user, mapped to the user column. They broadcast on a topic per user that only that user receives.",
+          "type": "object",
+          "additionalProperties": {
+            "type": "string"
+          }
+        },
+        "policies": {
+          "description": "Writes the realtime.messages policies of the topics `from` exports (defineTopic) to `output` on `sql sync`; `sql sync --check` fails when the file is stale.",
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["from", "output"],
+          "properties": {
+            "from": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            },
+            "output": {
+              "type": "string"
+            }
+          }
         }
       }
     },
@@ -361,25 +1076,50 @@
       "type": "object",
       "additionalProperties": false,
       "properties": {
-        "dir": { "type": "string", "default": "supabase/schemas" },
-        "prefix": { "type": "string", "default": "900_better_supabase" },
-        "testsDir": { "type": "string", "default": "supabase/tests" },
-        "kit": { "type": "array", "items": { "type": "string" } }
+        "dir": {
+          "type": "string",
+          "default": "supabase/schemas"
+        },
+        "prefix": {
+          "type": "string",
+          "default": "900_better_supabase"
+        },
+        "testsDir": {
+          "type": "string",
+          "default": "supabase/tests"
+        },
+        "modules": {
+          "description": "The SQL modules to keep in sync: a list of names, or an object keyed by module name whose values set the module mode, names, permission keys and options.",
+          "oneOf": [
+            {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            },
+            {
+              "type": "object",
+              "properties": {
+                "access": {
+                  "$ref": "#/$defs/accessModule"
+                }
+              },
+              "additionalProperties": {
+                "$ref": "#/$defs/moduleConfig"
+              }
+            }
+          ]
+        }
       }
     },
-    "kits": {
-      "type": "object",
-      "description": "How each SQL kit module maps onto the database, keyed by module name.",
-      "properties": {
-        "access": { "$ref": "#/$defs/accessKit" }
-      },
-      "additionalProperties": { "$ref": "#/$defs/kitModule" }
-    },
     "seed": {
       "type": "object",
       "additionalProperties": false,
       "properties": {
-        "entry": { "type": "string", "default": "supabase/seed.ts" },
+        "entry": {
+          "type": "string",
+          "default": "supabase/seed.ts"
+        },
         "output": {
           "type": "string",
           "default": "supabase/seeds/000_better_supabase.sql"
@@ -390,8 +1130,14 @@
       "type": "object",
       "additionalProperties": false,
       "properties": {
-        "entry": { "type": "string", "default": "src/lib/openapi.ts" },
-        "output": { "type": "string", "default": "openapi.json" }
+        "entry": {
+          "type": "string",
+          "default": "src/lib/openapi.ts"
+        },
+        "output": {
+          "type": "string",
+          "default": "openapi.json"
+        }
       }
     },
     "doctor": {
@@ -400,90 +1146,201 @@
       "properties": {
         "ignore": {
           "type": "array",
-          "items": { "type": "string", "pattern": "^BS\\d{3}$" }
+          "items": {
+            "type": "string",
+            "pattern": "^BS\\d{3}$"
+          }
+        },
+        "strict": {
+          "type": "boolean"
+        },
+        "sources": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "policyHelperLimit": {
+          "type": "integer",
+          "minimum": 1
         },
-        "strict": { "type": "boolean" },
-        "sources": { "type": "array", "items": { "type": "string" } },
-        "policyHelperLimit": { "type": "integer", "minimum": 1 },
-        "claimsLimit": { "type": "integer", "minimum": 1 }
+        "claimsLimit": {
+          "type": "integer",
+          "minimum": 1
+        }
       }
     }
   },
   "$defs": {
     "stringRecord": {
       "type": "object",
-      "additionalProperties": { "type": "string" }
+      "additionalProperties": {
+        "type": "string"
+      }
     },
-    "kitModuleProperties": {
-      "mode": { "enum": ["managed", "adopt", "custom"], "default": "managed" },
-      "schema": { "type": "string", "default": "better_supabase" },
+    "moduleConfigProperties": {
+      "mode": {
+        "enum": ["managed", "adopt", "custom"],
+        "default": "managed"
+      },
+      "schema": {
+        "type": "string",
+        "default": "better_supabase"
+      },
       "tables": {
         "type": "object",
-        "additionalProperties": { "type": ["string", "null"] }
+        "additionalProperties": {
+          "type": ["string", "null"]
+        }
       },
       "columns": {
         "type": "object",
         "additionalProperties": {
           "type": "object",
-          "additionalProperties": { "type": ["string", "null"] }
+          "additionalProperties": {
+            "type": ["string", "null"]
+          }
         }
       },
-      "idType": { "type": "string" },
-      "triggerPrefix": { "type": "string", "default": "bs_" },
-      "permissions": { "$ref": "#/$defs/stringRecord" },
-      "options": { "type": "object" }
+      "idType": {
+        "type": "string"
+      },
+      "triggerPrefix": {
+        "type": "string",
+        "default": "bs_"
+      },
+      "permissions": {
+        "$ref": "#/$defs/stringRecord"
+      },
+      "options": {
+        "type": "object"
+      },
+      "api": {
+        "oneOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["schema"],
+            "properties": {
+              "schema": {
+                "type": "string"
+              },
+              "functions": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              }
+            }
+          }
+        ]
+      }
     },
-    "kitModule": {
+    "moduleConfig": {
       "type": "object",
       "additionalProperties": false,
       "properties": {
-        "mode": { "$ref": "#/$defs/kitModuleProperties/mode" },
-        "schema": { "$ref": "#/$defs/kitModuleProperties/schema" },
-        "tables": { "$ref": "#/$defs/kitModuleProperties/tables" },
-        "columns": { "$ref": "#/$defs/kitModuleProperties/columns" },
-        "idType": { "$ref": "#/$defs/kitModuleProperties/idType" },
+        "mode": {
+          "$ref": "#/$defs/moduleConfigProperties/mode"
+        },
+        "schema": {
+          "$ref": "#/$defs/moduleConfigProperties/schema"
+        },
+        "tables": {
+          "$ref": "#/$defs/moduleConfigProperties/tables"
+        },
+        "columns": {
+          "$ref": "#/$defs/moduleConfigProperties/columns"
+        },
+        "idType": {
+          "$ref": "#/$defs/moduleConfigProperties/idType"
+        },
         "triggerPrefix": {
-          "$ref": "#/$defs/kitModuleProperties/triggerPrefix"
+          "$ref": "#/$defs/moduleConfigProperties/triggerPrefix"
+        },
+        "permissions": {
+          "$ref": "#/$defs/moduleConfigProperties/permissions"
         },
-        "permissions": { "$ref": "#/$defs/kitModuleProperties/permissions" },
-        "options": { "$ref": "#/$defs/kitModuleProperties/options" }
+        "options": {
+          "$ref": "#/$defs/moduleConfigProperties/options"
+        },
+        "api": {
+          "$ref": "#/$defs/moduleConfigProperties/api"
+        }
       }
     },
-    "accessKit": {
+    "accessModule": {
       "type": "object",
       "additionalProperties": false,
       "properties": {
-        "mode": { "$ref": "#/$defs/kitModuleProperties/mode" },
-        "schema": { "$ref": "#/$defs/kitModuleProperties/schema" },
-        "tables": { "$ref": "#/$defs/kitModuleProperties/tables" },
-        "columns": { "$ref": "#/$defs/kitModuleProperties/columns" },
-        "idType": { "$ref": "#/$defs/kitModuleProperties/idType" },
+        "mode": {
+          "$ref": "#/$defs/moduleConfigProperties/mode"
+        },
+        "schema": {
+          "$ref": "#/$defs/moduleConfigProperties/schema"
+        },
+        "tables": {
+          "$ref": "#/$defs/moduleConfigProperties/tables"
+        },
+        "columns": {
+          "$ref": "#/$defs/moduleConfigProperties/columns"
+        },
+        "idType": {
+          "$ref": "#/$defs/moduleConfigProperties/idType"
+        },
         "triggerPrefix": {
-          "$ref": "#/$defs/kitModuleProperties/triggerPrefix"
+          "$ref": "#/$defs/moduleConfigProperties/triggerPrefix"
+        },
+        "permissions": {
+          "$ref": "#/$defs/moduleConfigProperties/permissions"
+        },
+        "options": {
+          "$ref": "#/$defs/moduleConfigProperties/options"
+        },
+        "api": {
+          "$ref": "#/$defs/moduleConfigProperties/api"
         },
-        "permissions": { "$ref": "#/$defs/kitModuleProperties/permissions" },
-        "options": { "$ref": "#/$defs/kitModuleProperties/options" },
         "model": {
-          "enum": ["roles", "catalog", "permdock", "custom"],
+          "enum": ["roles", "catalog", "provider", "custom"],
           "default": "roles"
         },
         "roles": {
           "type": "object",
           "additionalProperties": {
             "type": "array",
-            "items": { "type": "string" }
+            "items": {
+              "type": "string"
+            }
           }
         },
         "functions": {
           "type": "object",
           "additionalProperties": false,
           "properties": {
-            "can": { "type": "string" },
-            "tenantIdsWith": { "type": "string" },
-            "isPlatform": { "type": "string" },
-            "canUser": { "type": "string" },
-            "canAssign": { "type": "string" },
-            "permissionClaims": { "type": "string" }
+            "can": {
+              "type": "string"
+            },
+            "tenantIdsWith": {
+              "type": "string"
+            },
+            "isPlatform": {
+              "type": "string"
+            },
+            "canUser": {
+              "type": "string"
+            },
+            "canAssign": {
+              "type": "string"
+            },
+            "permissionClaims": {
+              "type": "string"
+            },
+            "canAssignFor": {
+              "type": "string"
+            }
           }
         },
         "platformClaim": {
@@ -494,40 +1351,117 @@
           "type": "object",
           "additionalProperties": false,
           "properties": {
-            "tenant": { "type": "string" },
-            "tenantKey": { "type": "string" },
-            "user": { "type": "string" },
-            "userKey": { "type": "string" }
+            "tenant": {
+              "oneOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "object",
+                  "additionalProperties": false,
+                  "required": ["table", "id"],
+                  "properties": {
+                    "table": {
+                      "type": "string"
+                    },
+                    "id": {
+                      "type": "string"
+                    },
+                    "disabledAt": {
+                      "type": "string"
+                    },
+                    "status": {
+                      "type": "string"
+                    },
+                    "active": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      }
+                    }
+                  }
+                }
+              ]
+            },
+            "tenantKey": {
+              "type": "string"
+            },
+            "user": {
+              "oneOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "object",
+                  "additionalProperties": false,
+                  "required": ["table", "id"],
+                  "properties": {
+                    "table": {
+                      "type": "string"
+                    },
+                    "id": {
+                      "type": "string"
+                    },
+                    "disabledAt": {
+                      "type": "string"
+                    },
+                    "status": {
+                      "type": "string"
+                    },
+                    "active": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      }
+                    }
+                  }
+                }
+              ]
+            },
+            "userKey": {
+              "type": "string"
+            }
           }
         },
         "activeTenant": {
           "oneOf": [
-            { "enum": ["claim", "resolver"] },
+            {
+              "enum": ["claim", "resolver"]
+            },
             {
               "type": "object",
               "additionalProperties": false,
               "required": ["profileColumn"],
               "properties": {
-                "profileColumn": { "type": "string" },
-                "key": { "type": "string" }
+                "profileColumn": {
+                  "type": "string"
+                },
+                "key": {
+                  "type": "string"
+                }
               }
             }
           ]
-        },
-        "permdock": {
-          "type": "object",
-          "additionalProperties": false,
-          "properties": {
-            "schema": { "type": "string" },
-            "scope": { "type": "string" }
-          }
         }
       }
     },
-    "casing": { "enum": ["snake", "camel"] },
+    "casing": {
+      "enum": ["snake", "camel"]
+    },
     "privileges": {
       "type": "array",
-      "items": { "enum": ["select", "insert", "update", "delete"] }
+      "items": {
+        "anyOf": [
+          {
+            "enum": ["select", "insert", "update", "delete"]
+          },
+          {
+            "description": "A column privilege, such as `update(title, body)`.",
+            "type": "string",
+            "pattern": "^(select|insert|update)\\s*\\(\\s*[a-z_][a-z0-9_$]*(\\s*,\\s*[a-z_][a-z0-9_$]*)*\\s*\\)$"
+          }
+        ]
+      }
     }
   }
 }