better-supabase 0.5.0 → 0.6.0

package/dist/{config-T_ejwyd3.d.ts → config-D44Y7PAv.d.ts}

@@ -1,148 +1,135 @@
 /// <reference lib="esnext.temporal" />
-import { a as BucketPolicyName, j as SchemaMeta, o as Casing, t as AccessBucketPolicy, x as PermdockBucketPolicy } from "./types-Dnf_wRDz.js";
-import { GeneratorMetadata } from "@supabase/postgrest-typegen";
-//#region src/config/kits.d.ts
+import { P as SchemaMeta, U as BucketLifecycle, c as Casing, s as BucketPolicyName, t as AccessBucketPolicy } from "./types-6BdhkmZe.js";
+import { s as ModulesConfig } from "./modules-DpPwzC7E.js";
+import { i as AuthorizationProvider } from "./authorization-BFCqamMs.js";
+//#region src/config/generator-metadata.d.ts
 /**
- * `kits` in `better-supabase.config.ts`: how each SQL kit module maps onto
- * the app's database. A module's contract (the functions other modules and
- * the TypeScript side call) stays the same in every mode; only the tables
- * behind it change.
+ * A copy of `@supabase/postgrest-typegen`'s `GeneratorMetadata` contract
+ * (version 1), so the published types don't reference the package: it is an
+ * optional peer that only the CLI loads. `tests/config/generator-metadata.test-d.ts`
+ * checks the copy against the pinned version.
  */
-/**
- * `managed`: the kit owns its tables. `adopt`: the kit writes its functions
- * and views over tables the app already has (`tables` and `columns`), never
- * `create table`. `custom`: the app implements the contract functions itself;
- * the kit writes nothing and doctor checks the signatures (BS307).
- */
-type KitMode = "managed" | "adopt" | "custom";
-/** Options every module takes. */
-interface KitModuleConfig {
-  readonly mode?: KitMode;
-  /** Schema of the module's functions and managed tables. Defaults to `better_supabase`. */
-  readonly schema?: string;
-  /**
-   * Logical table to `table` or `schema.table`, e.g.
-   * `{ memberships: 'public.organization_users' }`. An unqualified name is in
-   * `schema`. `null` marks an optional table the app doesn't have.
-   */
-  readonly tables?: Readonly<Record<string, string | null>>;
-  /**
-   * Logical table to logical column to column name, e.g.
-   * `{ memberships: { tenant: 'organization_id', role: 'role_id' } }`.
-   * `null` marks an optional column the adopted table doesn't have.
-   */
-  readonly columns?: Readonly<Record<string, Readonly<Record<string, string | null>>>>;
-  /** Type of tenant ids: `uuid` (default), `text`, `bigint` or `integer`. */
-  readonly idType?: string;
-  /**
-   * Kit action to permission key, checked through the access contract, e.g.
-   * `{ invite: 'organization.members.invite' }`.
-   */
-  readonly permissions?: Readonly<Record<string, string>>;
-  /** Module-specific options; each module's docs page lists them. */
-  readonly options?: Readonly<Record<string, unknown>>;
-  /**
-   * The app's optional `before_*` and `after_*` functions the module calls
-   * when they exist, e.g. `after_organization_create(org, user)`. They are
-   * looked up in `schema` (default `public`); `functions` maps a hook name
-   * to another function, e.g. `{ after_organization_create: 'app.seed_org' }`.
-   */
-  readonly hooks?: {
-    readonly schema?: string;
-    readonly functions?: Readonly<Record<string, string>>;
-  };
-  /**
-   * Whether the module writes its events to the outbox (`emit_event`) when
-   * the `outbox` module is installed. Defaults to true.
-   */
-  readonly events?: boolean;
-}
-/**
- * Where the active tenant of a request comes from. Every source counts only
- * while the caller is a member, so a stale claim or setting grants nothing.
- */
-type ActiveTenantSource = "claim" | "resolver" | {
-  readonly profileColumn: string;
-  readonly key?: string;
-};
-/** URL tenancy: the tenant comes from the request (a slug), not a stored setting. */
-declare const DEFAULT_ACTIVE_TENANT: ActiveTenantSource;
-/**
- * The access contract every kit checks permissions through:
- * `can(scope, id, permission)`, `tenant_ids_with(permission)`,
- * `is_platform(permission)` and `can_user(user, scope, id, permission)`.
- */
-interface AccessKitConfig extends KitModuleConfig {
-  /**
-   * `roles`: a fixed role list from `roles` (the default). `catalog`: role,
-   * permission and override tables (`tables.roles`, `permissions`,
-   * `rolePermissions`, `overrides`, `platformAssignments`). `permdock`:
-   * PermDock's `permitted_<scope>_ids` and `permdock_has`. `custom`:
-   * expression templates in `functions`.
-   */
-  readonly model?: "roles" | "catalog" | "permdock" | "custom";
-  /**
-   * `roles` model: role name to permission keys. `*` grants everything and
-   * `prefix.*` a prefix. Defaults to owner, admin, member and viewer.
-   */
-  readonly roles?: Readonly<Record<string, readonly string[]>>;
-  /**
-   * `custom` model: SQL expressions with `{scope}`, `{id}`, `{permission}`
-   * and `{user}` placeholders, e.g.
-   * `{ can: 'public.authorize_scope({scope}::public.scope_type, {id}, {permission})' }`.
-   */
-  readonly functions?: {
-    readonly can?: string;
-    readonly tenantIdsWith?: string;
-    readonly isPlatform?: string;
-    readonly canUser?: string;
-    /** `{tenant}` and `{role}`: whether the caller may assign the role. Defaults to true. */
-    readonly canAssign?: string;
-    /** `{user}`: the permission claim for the access token hook. */
-    readonly permissionClaims?: string;
-  };
-  /**
-   * `roles` model: the JWT claim holding the caller's platform permission
-   * keys (an array). Defaults to `platform_permissions`.
-   */
-  readonly platformClaim?: string;
-  /**
-   * Columns that disable a tenant or a user when set, as
-   * `schema.table.column`, keyed by the table's `id` (tenant) or the column
-   * named in `userKey` (user). Disabled tenants and users get no permissions.
-   */
-  readonly disabled?: {
-    readonly tenant?: string;
-    readonly user?: string;
-    readonly userKey?: string;
-  };
-  readonly activeTenant?: ActiveTenantSource;
-  /** `permdock` model: PermDock's `rls.schema` and the scope tenants are. */
-  readonly permdock?: {
-    readonly schema?: string;
-    readonly scope?: string;
-  };
-}
-/** `kits` in the config, keyed by module name. */
-interface KitsConfig {
-  readonly access?: AccessKitConfig;
-  /** `AccessKitConfig` is listed so an `access` literal passes the excess-property check. */
-  readonly [module: string]: KitModuleConfig | AccessKitConfig | undefined;
-}
-/** A module's config with defaults applied. */
-interface ResolvedKitModule {
-  readonly mode: KitMode;
-  readonly schema: string;
-  readonly tables: Readonly<Record<string, string | null>>;
-  readonly columns: Readonly<Record<string, Readonly<Record<string, string | null>>>>;
-  readonly idType?: string;
-  readonly permissions: Readonly<Record<string, string>>;
-  readonly options: Readonly<Record<string, unknown>>;
-  readonly hooks: {
-    readonly schema: string;
-    readonly functions: Readonly<Record<string, string>>;
-  };
-  readonly events: boolean;
+interface PostgresColumn {
+  table_id: number;
+  schema: string;
+  table: string;
+  id: string;
+  ordinal_position: number;
+  name: string;
+  default_value: unknown;
+  data_type: string;
+  format: string;
+  type_schema: string;
+  is_identity: boolean;
+  identity_generation: "ALWAYS" | "BY DEFAULT" | null;
+  is_generated: boolean;
+  is_nullable: boolean;
+  is_updatable: boolean;
+  is_unique: boolean;
+  enums: string[];
+  check: string | null;
+  comment: string | null;
+}
+interface PostgresFunctionArg {
+  mode: "in" | "inout" | "out" | "table" | "variadic";
+  name: string;
+  type_id: number;
+  has_default: boolean | null;
+}
+interface PostgresFunction {
+  id: number;
+  schema: string;
+  name: string;
+  language: string;
+  definition: string;
+  complete_statement: string;
+  args: PostgresFunctionArg[];
+  argument_types: string;
+  identity_argument_types: string;
+  return_type_id: number;
+  return_type: string;
+  return_type_relation_id: number | null;
+  is_set_returning_function: boolean;
+  prorows: number | null;
+  behavior: "IMMUTABLE" | "STABLE" | "VOLATILE";
+  security_definer: boolean;
+  config_params: {
+    [x: string]: string;
+  } | null;
+}
+interface GeneratorMetadata {
+  version: 1;
+  schemas: {
+    id: number;
+    name: string;
+    owner: string;
+  }[];
+  tables: {
+    bytes: number;
+    comment: string | null;
+    dead_rows_estimate: number;
+    id: number;
+    live_rows_estimate: number;
+    name: string;
+    replica_identity: "DEFAULT" | "FULL" | "INDEX" | "NOTHING";
+    rls_enabled: boolean;
+    rls_forced: boolean;
+    schema: string;
+    size: string;
+  }[];
+  foreignTables: {
+    comment: string | null;
+    id: number;
+    name: string;
+    schema: string;
+  }[];
+  views: {
+    comment: string | null;
+    id: number;
+    is_insert_enabled?: boolean | undefined;
+    is_updatable: boolean;
+    is_update_enabled?: boolean | undefined;
+    name: string;
+    schema: string;
+  }[];
+  materializedViews: {
+    comment: string | null;
+    id: number;
+    is_populated: boolean;
+    name: string;
+    schema: string;
+  }[];
+  columns: PostgresColumn[];
+  primaryKeys: {
+    schema: string;
+    table_name: string;
+    name: string;
+    table_id: number;
+  }[];
+  relationships: {
+    foreign_key_name: string;
+    schema: string;
+    relation: string;
+    columns: string[];
+    is_one_to_one: boolean;
+    referenced_schema: string;
+    referenced_relation: string;
+    referenced_columns: string[];
+  }[];
+  functions: PostgresFunction[];
+  types: {
+    id: number;
+    name: string;
+    schema: string;
+    format: string;
+    enums: string[];
+    attributes: {
+      name: string;
+      type_id: number;
+    }[];
+    comment: string | null;
+    type_relation_id: number | null;
+  }[];
 }
 //#endregion
 //#region src/config/snapshot.d.ts
@@ -182,6 +169,13 @@ interface SnapshotExtras {
    * in any schema. Absent in older snapshots and without a `config.toml`.
    */
   readonly hooks?: readonly ExtrasHook[];
+  /**
+   * Set when the snapshot comes from a `GeneratorMetadata` document alone
+   * (`gen --metadata`): unique keys, checks and foreign keys are inferred from
+   * the columns and relationships, and the rest is empty, so doctor skips
+   * the rules that read it.
+   */
+  readonly fromMetadata?: true;
 }
 /** An `[auth.hook.<name>]` with a `pg-functions://` URI. */
 interface ExtrasHook {
@@ -209,7 +203,7 @@ interface ExtrasHookFunction extends ExtrasFunction {
 interface ExtrasFunction {
   readonly schema: string;
   readonly name: string;
-  /** Identity arguments, e.g. `org uuid`. */
+  /** Identity arguments, e.g. `organization uuid`. */
   readonly signature: string;
   /** `sql`, `plpgsql`, `c`, ... */
   readonly language: string;
@@ -298,6 +292,10 @@ interface SnapshotBucket {
   readonly public: boolean;
   readonly fileSizeLimit: number | null;
   readonly allowedMimeTypes: readonly string[] | null;
+  /** `versioning_status`; absent when Storage has no versioning. */
+  readonly versioning?: "DISABLED" | "ENABLED" | "SUSPENDED" | null;
+  /** `lifecycle_configuration`; absent when Storage has no lifecycles. */
+  readonly lifecycle?: unknown;
 }
 /**
  * The snapshot joined into one record per table, function and enum. Codegen
@@ -379,9 +377,13 @@ interface CatalogFunction {
   readonly returnsTable: readonly {
     readonly name: string;
     readonly udt: string;
+    /** Schema of the column's type, when typegen knows it. */
+    readonly typeSchema?: string;
   }[] | null;
   /** Return type name (`int4`, `_text`, a table's row type). */
   readonly returns: string;
+  /** Schema of the return type, when typegen knows it. */
+  readonly returnsSchema?: string;
   /** `schema.table` when the function returns rows of a table or view. */
   readonly returnsRelation: string | null;
   readonly returnsSet: boolean;
@@ -394,6 +396,8 @@ interface CatalogFunction {
 interface CatalogFunctionArg {
   readonly name: string;
   readonly udt: string;
+  /** Schema of the argument's type, when typegen knows it. */
+  readonly typeSchema?: string;
   readonly isArray: boolean;
   readonly hasDefault: boolean;
 }
@@ -446,8 +450,25 @@ interface TableConfig {
   readonly casing?: Casing;
   /** Leave the table out of the generated models. */
   readonly exclude?: boolean;
+  /**
+   * Keep the table off the Data API on purpose: only `service_role` reaches
+   * it. The models are still generated for admin clients, and doctor (BS106)
+   * checks that `anon` and `authenticated` have no grants instead of
+   * requiring them.
+   */
+  readonly serviceRole?: boolean;
   /** Rename generated relations: `{ primaryContact: 'contact' }`. */
   readonly relations?: Readonly<Record<string, string>>;
+  /**
+   * Database names of not-null columns an insert may leave out because the
+   * database fills them, for example from a `before insert` trigger. `gen`
+   * makes them optional in `InsertOf` and the insert validators.
+   */
+  readonly insertOptional?: readonly string[];
+}
+interface FunctionConfig {
+  /** `true`, or the `returns table` columns (database names) that are never null. */
+  readonly notNull?: true | readonly string[];
 }
 interface TimestampsConfig {
   readonly createdAt?: string;
@@ -459,10 +480,7 @@ interface SoftDeleteConfig {
 interface TenantConfig {
   readonly column?: string;
 }
-/**
- * Claim names shared by the SQL kit, codegen and the runtime defaults. They
- * follow PermDock's claim contract.
- */
+/** Claim names shared by the SQL modules, codegen and the runtime defaults. */
 interface ClaimsConfig {
   /** Top-level claim holding the active tenant id. Defaults to `tenant_id`. */
   readonly tenant?: string;
@@ -470,11 +488,13 @@ interface ClaimsConfig {
   readonly scope?: string;
   /** Claim holding plan features per tenant (`{ [tenantId]: string[] }`). Defaults to `features`. */
   readonly features?: string;
+  /** Claim the memberships hook (`membership_claims()` or the provider's) writes. Defaults to `memberships`. */
+  readonly memberships?: string;
 }
 interface ActorConfig {
   readonly createdBy?: string;
   readonly updatedBy?: string;
-  /** Defaults to `impersonated_by`, the column the SQL kit's `track_actor` fills. */
+  /** Defaults to `impersonated_by`, the column the SQL modules' `track_actor` fills. */
   readonly impersonatedBy?: string;
 }
 interface PluginFlagsConfig {
@@ -486,15 +506,20 @@ interface PluginFlagsConfig {
 interface BucketConfig {
   readonly id?: string;
   readonly public?: boolean;
-  /** Path template with `{placeholders}`, e.g. `{orgId}/{customerId}/logo.webp`. */
-  readonly path: string;
   /**
-   * Generated storage policy, a PermDock policy (`{ permdock, scope }`) or
-   * an access contract policy (`{ access }`).
+   * Path template with `{placeholders}`, e.g. `{organizationId}/{customerId}/logo.webp`,
+   * or several when the bucket stores objects in more than one layout. A last
+   * segment `{...rest}` matches one or more segments.
    */
-  readonly policy?: BucketPolicyName | PermdockBucketPolicy | AccessBucketPolicy;
+  readonly path: string | readonly [string, ...string[]];
+  /** Generated storage policy, or an access contract policy (`{ access }`). */
+  readonly policy?: BucketPolicyName | AccessBucketPolicy;
   readonly fileSizeLimit?: string;
   readonly allowedMimeTypes?: readonly string[];
+  /** Keep earlier object versions. `bucket.apply()` sets it; doctor (BS302) compares it. */
+  readonly versioning?: boolean;
+  /** When noncurrent versions expire. Needs `versioning: true`. */
+  readonly lifecycle?: BucketLifecycle;
 }
 interface SqlConfig {
   /** Directory declarative schema files are written to. */
@@ -503,8 +528,20 @@ interface SqlConfig {
   readonly prefix?: string;
   /** Directory pgTAP files (the `pgtap` module) are written to. */
   readonly testsDir?: string;
-  /** SQL kit modules to keep in sync (`better-supabase sql add`). */
-  readonly kit?: readonly string[];
+  /**
+   * The SQL modules to keep in sync (`better-supabase sql add`): a list of
+   * names, or an object keyed by module name whose values set each module's
+   * mode, schema, table and column names, permission keys and options.
+   */
+  readonly modules?: readonly string[] | ModulesConfig;
+}
+/** `sql` with defaults applied: settings per module, and their names in order. */
+interface ResolvedSqlConfig {
+  readonly dir: string;
+  readonly prefix: string;
+  readonly testsDir: string;
+  readonly modules: ModulesConfig;
+  readonly moduleNames: readonly string[];
 }
 interface SeedConfig {
   /** Module exporting `defineSeed(...)` as `seed` or default. */
@@ -534,10 +571,9 @@ interface DoctorConfig {
    */
   readonly policyHelperLimit?: number;
   /**
-   * The BS405 limit in bytes. With a `permdock.config.ts` it is PermDock's
-   * budget for `memberships` plus `attrs` (default 1024, matching
-   * `supabase.hook.budget`) and the whole token keeps 2048. Without one it
-   * limits the whole token's claims (default 2048).
+   * The BS405 limit in bytes. When the authorization provider's token hook
+   * has a budget, it replaces that budget and the whole token keeps 2048.
+   * Otherwise it limits the whole token's claims (default 2048).
    */
   readonly claimsLimit?: number;
 }
@@ -576,12 +612,51 @@ interface GeneratorInput {
   readonly output: string;
   /** Import path from `from` (a generated file) to `to`, with extension. */
   readonly importPath: (from: string, to: string) => string;
+  /**
+   * The tables and enums `gen` emits, with the TypeScript type it wrote for
+   * each column (after `json` overrides, codecs and enum unions). Frozen.
+   */
+  readonly model: GeneratorModel;
+}
+interface GeneratorColumn {
+  /** Name in rows, after casing. */
+  readonly app: string;
+  /** Database name. */
+  readonly db: string;
+  /** TypeScript type without `| null`. */
+  readonly tsType: string;
+  readonly nullable: boolean;
+  /** Optional on insert. */
+  readonly optional: boolean;
+  /** Generated or identity always: never written. */
+  readonly readonly: boolean;
+  /** Enum or check-constraint values, when the column has a closed set. */
+  readonly values: readonly string[] | undefined;
+  readonly json: boolean;
+}
+interface GeneratorTable {
+  /** Key in `schema.tables` and on the client. */
+  readonly key: string;
+  readonly schema: string;
+  readonly name: string;
+  readonly casing: Casing;
+  readonly columns: readonly GeneratorColumn[];
+}
+interface GeneratorModel {
+  readonly tables: readonly GeneratorTable[];
+  readonly enums: readonly {
+    readonly schema: string;
+    readonly name: string;
+    readonly values: readonly string[];
+  }[];
 }
 /**
  * Codegen extension point. First-party generators: `zod()`, `valibot()`,
  * `jsonSchema()`. Prove custom ones with `testGenerator`.
  */
 interface Generator {
+  /** The generator contract it targets. `gen` refuses versions it doesn't know. */
+  readonly apiVersion?: 1;
   readonly name: string;
   generate(input: GeneratorInput): readonly GeneratedFile[] | Promise<readonly GeneratedFile[]>;
 }
@@ -598,11 +673,31 @@ interface RealtimeConfig {
    * lacks the tenant column and is not listed here fails to install.
    */
   readonly global?: readonly string[];
+  /**
+   * Tables in `tables` whose rows belong to one user: table to its user
+   * column (`{ notifications: "user_id" }`). They broadcast on a topic per
+   * user, `bs:t:<schema>.<table>:u:<user id>`, which only that user
+   * receives, instead of the tenant's topic.
+   */
+  readonly users?: Readonly<Record<string, string>>;
+  /**
+   * Writes the `realtime.messages` policies of the topics that `from`
+   * exports (`defineTopic`) to `output`, a file in `supabase/schemas`, on
+   * `better-supabase sql sync`; `sql sync --check` fails when it is stale.
+   */
+  readonly policies?: TopicPoliciesConfig;
+}
+/** `realtime.policies`: where topic policies come from and go. */
+interface TopicPoliciesConfig {
+  /** Modules that export `defineTopic` results. Node imports them. */
+  readonly from: readonly string[];
+  /** The SQL file to write, such as `supabase/schemas/905_topics.sql`. */
+  readonly output: string;
 }
 interface EntitlementsConfig {
   /**
    * `table.column` (or `schema.table.column`) holding each tenant's Stripe
-   * customer id, read by the `entitlements` SQL kit module. Required
+   * customer id, read by the `entitlements` SQL module. Required
    * without the `organizations` module; with it, defaults to the
    * `stripe_customer_id` column that module adds.
    */
@@ -610,22 +705,64 @@ interface EntitlementsConfig {
   /** The tenant id column of that table. Defaults to `id`. */
   readonly key?: string;
   /**
-   * With a PermDock manifest, `has_entitlement` and `feature_claims` read
-   * PermDock's memberships (`member_<scope>_ids()` and
-   * `member_<scope>_ids_for(user)`) instead of `better_supabase.memberships`.
-   * `scope` is the PermDock scope tenants are. It defaults to the manifest's
-   * root scope (the `rls.scopes` entry without `within`); `false` keeps the
-   * kit's memberships table.
+   * Where `has_entitlement` and `feature_claims` read memberships from.
+   * `"provider"` calls the authorization provider's `memberIds` and
+   * `memberIdsFor` functions; `"tenant"` reads `better_supabase.memberships`.
+   * Defaults to `"provider"` when `authorization` is set, else `"tenant"`.
    */
-  readonly permdock?: false | {
-    readonly scope?: string;
+  readonly memberships?: "tenant" | "provider";
+  /**
+   * Where each tenant's entitlements come from. `"stripe-sync"` (the
+   * default) reads the Stripe Sync Engine's `stripe.active_entitlements`
+   * through `customer`. `{ plans }` reads a plan catalog: the tenant's
+   * active subscription and the features its plan includes. `"custom"`
+   * leaves `better_supabase.tenant_entitlements(tenant)` to you; the module
+   * writes the checks and the claim over it.
+   */
+  readonly source?: "stripe-sync" | "custom" | EntitlementPlansSource;
+  /**
+   * The shape of the features claim `feature_claims` writes, which every
+   * token carries. `false` writes `{}` (check entitlements in SQL with
+   * `has_entitlement` only); `maxTenants` keeps at most that many tenants;
+   * `keys` writes short codes instead of the feature keys. Pass the same
+   * `keys` to `hasEntitlement`.
+   */
+  readonly claim?: false | {
+    readonly maxTenants?: number;
+    readonly keys?: Readonly<Record<string, string>>;
   };
 }
-interface PermdockPathsConfig {
-  /** What `permdock supabase inspect --out` writes. Defaults to `permdock.manifest.json`. */
-  readonly manifest?: string;
-  /** What `permdock catalog` writes. Defaults to `permissions.catalog.json`. */
-  readonly catalog?: string;
+/** `entitlements.source.plans`: a plan catalog in your own tables. */
+interface EntitlementPlansSource {
+  readonly plans: {
+    readonly subscriptions: {
+      /** `table` or `schema.table`. */
+      readonly table: string;
+      /** The tenant id column. */
+      readonly tenant: string;
+      /** The plan key column. */
+      readonly plan: string;
+      /** A status column; with it, only rows in `activeStatuses` count. */
+      readonly status?: string;
+      /** Defaults to `["active", "trialing"]`. */
+      readonly activeStatuses?: readonly string[];
+    };
+    readonly features: {
+      /** `table` or `schema.table`. */
+      readonly table: string;
+      /** The plan key column. */
+      readonly plan: string;
+      /** The feature key column: what `has_entitlement` and the claim name. */
+      readonly feature: string;
+      /** A boolean column; with it, only included features count. */
+      readonly included?: string;
+      /**
+       * A column with the feature's value (a number, text or jsonb), such as
+       * a limit, that `tenant_entitlement_value` returns.
+       */
+      readonly value?: string;
+    };
+  };
 }
 /** pgvector distance: `<=>` (cosine), `<->` (l2) or `<#>` (negative inner product). */
 type VectorDistance = "cosine" | "l2" | "inner_product";
@@ -633,21 +770,70 @@ type VectorDistance = "cosine" | "l2" | "inner_product";
 type VectorSearchConfig = string | {
   readonly column: string;
   readonly distance?: VectorDistance;
+  /** The column's pgvector type. Defaults to `vector`. */
+  readonly type?: "vector" | "halfvec";
+  /** The primary key column `db.$search({ score: true })` merges by. Defaults to `id`. */
+  readonly key?: string;
+  /**
+   * Fuses a full-text ranking over a `tsvector` column with the vector
+   * ranking (reciprocal rank fusion), for `db.$search({ text })`.
+   */
+  readonly hybrid?: {
+    readonly tsvector: string;
+    /** The query's text search configuration. Defaults to `simple`. */
+    readonly config?: string;
+    /** The RRF constant. Defaults to 60. */
+    readonly k?: number;
+  };
+  /** A SQL expression over the row `t` the score is multiplied by, such as `t.priority`. */
+  readonly boost?: string;
+  /** Columns `db.$search({ filter })` narrows before ranking. */
+  readonly prefilter?: readonly string[];
+  /**
+   * A SQL condition over the row `t` every candidate must meet, applied
+   * before ranking: ranges, a parent row, such as
+   * `t.expires_at > now() and exists (select 1 from public.folders f where f.id = t.folder_id and not f.disabled)`.
+   */
+  readonly predicate?: string;
+  /** How `boost` combines with the score: `multiply` (default) or `add`. */
+  readonly boostMode?: "multiply" | "add";
+  /** A SQL `order by` list over the row `t` that breaks score ties, such as `t.created_at desc`. */
+  readonly order?: string;
 };
 /** A privilege the Data API roles can be granted on a table or view. */
 type Privilege = "select" | "insert" | "update" | "delete";
+type ColumnPrivilege = `${"select" | "insert" | "update"}(${string})`;
+type ExposePrivilege = Privilege | ColumnPrivilege;
+/** A role the `grants` module writes privileges for. */
+type ExposeRole = "anon" | "authenticated" | "service_role";
 /**
  * Data API grants for one table: privileges for `authenticated`, or per
- * role.
+ * role. `serviceRole` defaults to every privilege. For a function, keyed by
+ * its signature (`search_notes(text, integer)`), `execute` lists the roles
+ * that may call it; `service_role` is added unless `serviceRole` is false.
  */
-type ExposeConfig = readonly Privilege[] | {
-  readonly anon?: readonly Privilege[];
-  readonly authenticated?: readonly Privilege[];
+type ExposeConfig = readonly ExposePrivilege[] | {
+  readonly anon?: readonly ExposePrivilege[];
+  readonly authenticated?: readonly ExposePrivilege[];
+  readonly serviceRole?: readonly ExposePrivilege[];
+} | {
+  readonly execute: readonly ("anon" | "authenticated")[];
+  readonly serviceRole?: boolean;
 };
 /** Resolved grants for one table. */
 interface ResolvedExpose {
-  readonly anon: readonly Privilege[];
-  readonly authenticated: readonly Privilege[];
+  readonly anon: readonly ExposePrivilege[];
+  readonly authenticated: readonly ExposePrivilege[];
+  readonly serviceRole: readonly ExposePrivilege[];
+}
+interface RelationsConfig {
+  /**
+   * Type a to-one include as `| null` when the related table has row level
+   * security, even over a `not null` foreign key, since a policy can hide
+   * the related row. `required: true` on the include keeps it non-null.
+   * Defaults to `false`.
+   */
+  readonly nullableUnderRls?: boolean;
 }
 interface BetterSupabaseConfig {
   readonly $schema?: string;
@@ -671,6 +857,7 @@ interface BetterSupabaseConfig {
   /** Types for jsonb columns, keyed by `table.column`. */
   readonly json?: Readonly<Record<string, JsonTypeConfig>>;
   readonly codecs?: CodecsConfig;
+  readonly relations?: RelationsConfig;
   /**
    * Columns that must not be read by accident (`table.column` or
    * `schema.table.column`, database names), for the `noSensitiveSelect` rule.
@@ -684,16 +871,26 @@ interface BetterSupabaseConfig {
    */
   readonly storagePaths?: Readonly<Record<string, string>>;
   /**
-   * Data API grants, keyed by `table` or `schema.table`. Supabase no longer
-   * grants new tables to `anon` and `authenticated` automatically; the
-   * `grants` SQL kit module writes these, and doctor (BS106) checks them.
-   * Tables not listed need `select, insert, update, delete` for
-   * `authenticated` (`select` for views).
+   * Function results `gen` may type as not null, keyed by function name.
+   * Results are `| null` by default, since Postgres can't promise a function
+   * returns a value. `notNull: true` covers the whole result (each element
+   * of a set, each column of `returns table`); a list names the
+   * `returns table` columns that are never null.
+   */
+  readonly functions?: Readonly<Record<string, FunctionConfig>>;
+  /**
+   * Data API grants, keyed by `table` or `schema.table`, and function
+   * `execute` grants, keyed by `name(argument types)` or
+   * `schema.name(argument types)`. Supabase no longer grants new tables to
+   * `anon` and `authenticated` automatically; the `grants` SQL module writes
+   * these as the complete privilege set (it revokes what is not listed), and
+   * doctor (BS106) checks them. Tables not listed need `select, insert,
+   * update, delete` for `authenticated` (`select` for views).
    */
   readonly expose?: Readonly<Record<string, ExposeConfig>>;
   /**
    * Modules that export `defineReadSet` results. `gen` compiles each set to
-   * a function in the `read-sets` SQL kit module. Node imports them, so
+   * a function in the `read-sets` SQL module. Node imports them, so
    * relative imports need their `.ts` extension.
    */
   readonly readSets?: readonly string[];
@@ -702,25 +899,23 @@ interface BetterSupabaseConfig {
   readonly plugins?: PluginFlagsConfig;
   readonly claims?: ClaimsConfig;
   readonly buckets?: Readonly<Record<string, BucketConfig>>;
-  /** Realtime topic templates: `{ notifications: 'org:{orgId}:notifications' }`. */
+  /** Realtime topic templates: `{ notifications: 'organization:{organizationId}:notifications' }`. */
   readonly topics?: Readonly<Record<string, string>>;
   readonly realtime?: RealtimeConfig;
   readonly entitlements?: EntitlementsConfig;
-  /** Where PermDock's JSON outputs are, for doctor, `gen` and the SQL kit. */
-  readonly permdock?: PermdockPathsConfig;
+  /**
+   * An authorization system the SQL modules, policies and doctor delegate
+   * to: the `provider` access model, `entitlements.memberships` and the
+   * hook and policy checks.
+   */
+  readonly authorization?: AuthorizationProvider;
   /**
    * Embedding columns, keyed by `table` or `schema.table`. The
-   * `vector-search` SQL kit module writes `search_<table>(query, k)` for each,
+   * `vector-search` SQL module writes `search_<table>(query, k)` for each,
    * which `db.$search(table, { vector, k })` calls.
    */
   readonly vectorSearch?: Readonly<Record<string, VectorSearchConfig>>;
   readonly sql?: SqlConfig;
-  /**
-   * How each SQL kit module maps onto the database: `managed` tables, or
-   * `adopt` and `custom` over the app's own, with table, column and
-   * permission names, keyed by module name.
-   */
-  readonly kits?: KitsConfig;
   readonly seed?: SeedConfig;
   readonly openapi?: OpenApiConfig;
   readonly doctor?: DoctorConfig;
@@ -738,9 +933,14 @@ interface ResolvedConfig {
   readonly postgrestVersion: string;
   readonly json: Readonly<Record<string, JsonTypeConfig>>;
   readonly codecs: Required<CodecsConfig>;
+  readonly relations: Required<RelationsConfig>;
   readonly sensitive: readonly string[];
   readonly storagePaths: Readonly<Record<string, string>>;
+  readonly functions: Readonly<Record<string, FunctionConfig>>;
+  /** The table entries of `expose`. */
   readonly expose: Readonly<Record<string, ResolvedExpose>>;
+  /** The function entries of `expose`: the roles that may execute each one. */
+  readonly exposeFunctions: Readonly<Record<string, readonly ExposeRole[]>>;
   readonly readSets: readonly string[];
   readonly generators: readonly Generator[];
   readonly plugins: {
@@ -756,20 +956,21 @@ interface ResolvedConfig {
     readonly table?: string;
     readonly column?: string;
     readonly key: string;
-    readonly permdock: false | {
-      readonly scope?: string;
-    };
+    readonly memberships: "tenant" | "provider";
+    readonly source: NonNullable<EntitlementsConfig["source"]>;
+    readonly claim?: NonNullable<EntitlementsConfig["claim"]>;
   };
-  readonly permdock: Required<PermdockPathsConfig>;
-  readonly vectorSearch: readonly {
+  readonly authorization?: AuthorizationProvider;
+  readonly vectorSearch: readonly ({
     readonly table: string;
     readonly column: string;
     readonly distance: VectorDistance;
-  }[];
+  } & Omit<Exclude<VectorSearchConfig, string>, "column" | "distance">)[];
   readonly topics: Readonly<Record<string, string>>;
-  readonly realtime: Required<RealtimeConfig>;
-  readonly sql: Required<SqlConfig>;
-  readonly kits: KitsConfig;
+  readonly realtime: Required<Omit<RealtimeConfig, "policies">> & {
+    readonly policies?: TopicPoliciesConfig;
+  };
+  readonly sql: ResolvedSqlConfig;
   readonly seed: Required<SeedConfig>;
   readonly openapi: Required<OpenApiConfig>;
   readonly doctor: Required<Omit<DoctorConfig, "claimsLimit">> & Pick<DoctorConfig, "claimsLimit">;
@@ -780,4 +981,4 @@ declare function defineConfig(config: BetterSupabaseConfig): BetterSupabaseConfi
 /** Applies defaults. Paths stay relative to `root`. */
 declare function resolveConfig(config: BetterSupabaseConfig, root: string): ResolvedConfig;
 //#endregion
-export { GeneratorMetadata as $, VectorSearchConfig as A, CatalogFunction as B, SoftDeleteConfig as C, TenantConfig as D, TableConfig as E, CatalogCheck as F, CatalogTable as G, CatalogGrant as H, CatalogColumn as I, ExtrasFunction as J, CatalogTrigger as K, CatalogColumnGrant as L, resolveConfig as M, resolveJsonSchema as N, TimestampsConfig as O, Catalog as P, ForeignKeyAction as Q, CatalogEnum as R, SeedConfig as S, SqlConfig as T, CatalogIndex as U, CatalogFunctionArg as V, CatalogPolicy as W, ExtrasHookFunction as X, ExtrasHook as Y, ExtrasTable as Z, PluginFlagsConfig as _, ClaimsConfig as a, DEFAULT_ACTIVE_TENANT as at, ResolvedConfig as b, EntitlementsConfig as c, KitsConfig as ct, Generator as d, Snapshot as et, GeneratorInput as f, PermdockPathsConfig as g, OpenApiConfig as h, CONFIG_SCHEMA_URL as i, ActiveTenantSource as it, defineConfig as j, VectorDistance as k, ExposeConfig as l, ResolvedKitModule as lt, JsonTypeConfig as m, BetterSupabaseConfig as n, SnapshotExtras as nt, CodecsConfig as o, KitMode as ot, JsonSchemaSource as p, CatalogUnique as q, BucketConfig as r, AccessKitConfig as rt, DoctorConfig as s, KitModuleConfig as st, ActorConfig as t, SnapshotBucket as tt, GeneratedFile as u, Privilege as v, SourceConfig as w, ResolvedExpose as x, RealtimeConfig as y, CatalogForeignKey as z };
+export { CatalogTable as $, SeedConfig as A, resolveConfig as B, PluginFlagsConfig as C, ResolvedConfig as D, RelationsConfig as E, TenantConfig as F, CatalogColumnGrant as G, Catalog as H, TimestampsConfig as I, CatalogFunction as J, CatalogEnum as K, VectorDistance as L, SourceConfig as M, SqlConfig as N, ResolvedExpose as O, TableConfig as P, CatalogPolicy as Q, VectorSearchConfig as R, OpenApiConfig as S, RealtimeConfig as T, CatalogCheck as U, resolveJsonSchema as V, CatalogColumn as W, CatalogGrant as X, CatalogFunctionArg as Y, CatalogIndex as Z, GeneratorInput as _, ClaimsConfig as a, ExtrasTable as at, JsonSchemaSource as b, DoctorConfig as c, SnapshotBucket as ct, ExposeConfig as d, PostgresColumn as dt, CatalogTrigger as et, ExposePrivilege as f, PostgresFunction as ft, GeneratorColumn as g, Generator as h, CONFIG_SCHEMA_URL as i, ExtrasHookFunction as it, SoftDeleteConfig as j, ResolvedSqlConfig as k, EntitlementPlansSource as l, SnapshotExtras as lt, GeneratedFile as m, BetterSupabaseConfig as n, ExtrasFunction as nt, CodecsConfig as o, ForeignKeyAction as ot, ExposeRole as p, PostgresFunctionArg as pt, CatalogForeignKey as q, BucketConfig as r, ExtrasHook as rt, ColumnPrivilege as s, Snapshot as st, ActorConfig as t, CatalogUnique as tt, EntitlementsConfig as u, GeneratorMetadata as ut, GeneratorModel as v, Privilege as w, JsonTypeConfig as x, GeneratorTable as y, defineConfig as z };