node-type-registry 0.17.0 → 0.18.0

package/blueprint-types.generated.d.ts

@@ -39,12 +39,12 @@ export interface DataSoftDeleteParams {
 /** Dynamically creates PostgreSQL triggers that enqueue jobs via app_jobs.add_job() when table rows are inserted, updated, or deleted. Supports configurable payload strategies (full row, row ID, selected fields, or custom mapping), conditional firing via WHEN clauses, watched field changes, and extended job options (queue, priority, delay, max attempts). */
 export interface DataJobTriggerParams {
     task_identifier: string;
-    payload_strategy?: "row" | "row_id" | "fields" | "custom";
+    payload_strategy?: 'row' | 'row_id' | 'fields' | 'custom';
     payload_fields?: string[];
     payload_custom?: {
         [key: string]: unknown;
     };
-    events?: ("INSERT" | "UPDATE" | "DELETE")[];
+    events?: ('INSERT' | 'UPDATE' | 'DELETE')[];
     include_old?: boolean;
     include_meta?: boolean;
     condition_field?: string;
@@ -85,7 +85,7 @@ export interface DataSlugParams {
 /** Transforms field values using inflection operations (snake_case, camelCase, slugify, plural, singular, etc). Attaches BEFORE INSERT and BEFORE UPDATE triggers. References fields by name in data jsonb. */
 export interface DataInflectionParams {
     field_name: string;
-    ops: ("plural" | "singular" | "camel" | "pascal" | "dashed" | "slugify" | "underscore" | "lower" | "upper")[];
+    ops: ('plural' | 'singular' | 'camel' | 'pascal' | 'dashed' | 'slugify' | 'underscore' | 'lower' | 'upper')[];
 }
 /** Restricts which user can modify specific columns in shared objects. Creates an AFTER UPDATE trigger that throws OWNED_PROPS when a non-owner tries to change protected fields. References fields by name in data jsonb. */
 export interface DataOwnedFieldsParams {
@@ -111,7 +111,7 @@ export interface DataImmutableFieldsParams {
 export interface DataCompositeFieldParams {
     target?: string;
     source_fields: string[];
-    format?: "labeled" | "plain";
+    format?: 'labeled' | 'plain';
 }
 /** Creates a user profiles table with standard profile fields (profile_picture, bio, first_name, last_name, tags, desired). Uses AuthzDirectOwner for edit access and AuthzAllowAll for select. */
 export type TableUserProfilesParams = {};
@@ -123,8 +123,8 @@ export type TableUserSettingsParams = {};
 export interface SearchVectorParams {
     field_name?: string;
     dimensions?: number;
-    index_method?: "hnsw" | "ivfflat";
-    metric?: "cosine" | "l2" | "ip";
+    index_method?: 'hnsw' | 'ivfflat';
+    metric?: 'cosine' | 'l2' | 'ip';
     index_options?: {
         [key: string]: unknown;
     };
@@ -132,12 +132,12 @@ export interface SearchVectorParams {
     source_fields?: string[];
     enqueue_job?: boolean;
     job_task_name?: string;
-    stale_strategy?: "column" | "null" | "hash";
+    stale_strategy?: 'column' | 'null' | 'hash';
     chunks?: {
         content_field_name?: string;
         chunk_size?: number;
         chunk_overlap?: number;
-        chunk_strategy?: "fixed" | "sentence" | "paragraph" | "semantic";
+        chunk_strategy?: 'fixed' | 'sentence' | 'paragraph' | 'semantic';
         metadata_fields?: {
             [key: string]: unknown;
         };
@@ -150,7 +150,7 @@ export interface SearchFullTextParams {
     field_name?: string;
     source_fields: {
         field: string;
-        weight?: "A" | "B" | "C" | "D";
+        weight?: 'A' | 'B' | 'C' | 'D';
         lang?: string;
     }[];
     search_score_weight?: number;
@@ -169,7 +169,7 @@ export interface SearchUnifiedParams {
         field_name?: string;
         source_fields?: {
             field: string;
-            weight?: "A" | "B" | "C" | "D";
+            weight?: 'A' | 'B' | 'C' | 'D';
             lang?: string;
         }[];
         search_score_weight?: number;
@@ -184,15 +184,15 @@ export interface SearchUnifiedParams {
     embedding?: {
         field_name?: string;
         dimensions?: number;
-        index_method?: "hnsw" | "ivfflat";
-        metric?: "cosine" | "l2" | "ip";
+        index_method?: 'hnsw' | 'ivfflat';
+        metric?: 'cosine' | 'l2' | 'ip';
         source_fields?: string[];
         search_score_weight?: number;
         chunks?: {
             content_field_name?: string;
             chunk_size?: number;
             chunk_overlap?: number;
-            chunk_strategy?: "fixed" | "sentence" | "paragraph" | "semantic";
+            chunk_strategy?: 'fixed' | 'sentence' | 'paragraph' | 'semantic';
             metadata_fields?: {
                 [key: string]: unknown;
             };
@@ -205,7 +205,7 @@ export interface SearchUnifiedParams {
         weights?: {
             [key: string]: unknown;
         };
-        normalization?: "linear" | "sigmoid";
+        normalization?: 'linear' | 'sigmoid';
         boost_recent?: boolean;
         boost_recency_field?: string;
         boost_recency_decay?: number;
@@ -214,11 +214,11 @@ export interface SearchUnifiedParams {
 /** Adds a PostGIS geometry or geography column with a spatial index (GiST or SP-GiST). Supports configurable geometry types (Point, Polygon, etc.), SRID, and dimensionality. The graphile-postgis plugin auto-detects geometry/geography columns by codec type for spatial filtering (ST_Contains, ST_DWithin, bbox operators). */
 export interface SearchSpatialParams {
     field_name?: string;
-    geometry_type?: "Point" | "LineString" | "Polygon" | "MultiPoint" | "MultiLineString" | "MultiPolygon" | "GeometryCollection" | "Geometry";
+    geometry_type?: 'Point' | 'LineString' | 'Polygon' | 'MultiPoint' | 'MultiLineString' | 'MultiPolygon' | 'GeometryCollection' | 'Geometry';
     srid?: number;
     dimension?: 2 | 3 | 4;
     use_geography?: boolean;
-    index_method?: "gist" | "spgist";
+    index_method?: 'gist' | 'spgist';
 }
 /** Creates a derived/materialized geometry field on the parent table that automatically aggregates geometries from a source (child) table via triggers. When child rows are inserted/updated/deleted, the parent aggregate field is recalculated using the specified PostGIS aggregation function (ST_Union, ST_Collect, ST_ConvexHull, ST_ConcaveHull). Useful for materializing spatial boundaries from collections of points or polygons. */
 export interface SearchSpatialAggregateParams {
@@ -226,12 +226,12 @@ export interface SearchSpatialAggregateParams {
     source_table_id: string;
     source_geom_field?: string;
     source_fk_field: string;
-    aggregate_function?: "union" | "collect" | "convex_hull" | "concave_hull";
-    geometry_type?: "Point" | "LineString" | "Polygon" | "MultiPoint" | "MultiLineString" | "MultiPolygon" | "GeometryCollection" | "Geometry";
+    aggregate_function?: 'union' | 'collect' | 'convex_hull' | 'concave_hull';
+    geometry_type?: 'Point' | 'LineString' | 'Polygon' | 'MultiPoint' | 'MultiLineString' | 'MultiPolygon' | 'GeometryCollection' | 'Geometry';
     srid?: number;
     dimension?: 2 | 3 | 4;
     use_geography?: boolean;
-    index_method?: "gist" | "spgist";
+    index_method?: 'gist' | 'spgist';
 }
 /** Creates GIN trigram indexes (gin_trgm_ops) on specified text/citext fields for fuzzy LIKE/ILIKE/similarity search. Adds @trgmSearch smart tag for PostGraphile integration. Fields must already exist on the table. */
 export interface SearchTrgmParams {
@@ -281,7 +281,7 @@ export interface AuthzRelatedEntityMembershipParams {
 }
 /** Organizational hierarchy visibility using closure table. Managers can see subordinate data or subordinates can see manager data. */
 export interface AuthzOrgHierarchyParams {
-    direction: "up" | "down";
+    direction: 'up' | 'down';
     entity_field?: string;
     anchor_field: string;
     max_depth?: number;
@@ -318,7 +318,7 @@ export type AuthzDenyAllParams = {};
 /** Composite authorization policy that combines multiple authorization nodes using boolean logic (AND/OR). The data field contains a JSONB AST with nested authorization nodes. */
 export interface AuthzCompositeParams {
     BoolExpr?: {
-        boolop?: "AND_EXPR" | "OR_EXPR" | "NOT_EXPR";
+        boolop?: 'AND_EXPR' | 'OR_EXPR' | 'NOT_EXPR';
         args?: {
             [key: string]: unknown;
         }[];
@@ -360,7 +360,7 @@ export interface RelationBelongsToParams {
     source_table_id: string;
     target_table_id: string;
     field_name?: string;
-    delete_action: "c" | "r" | "n" | "d" | "a";
+    delete_action: 'c' | 'r' | 'n' | 'd' | 'a';
     is_required?: boolean;
 }
 /** Creates a foreign key field with a unique constraint on the source table referencing the target table. Enforces 1:1 cardinality. Auto-derives the FK field name from the target table name using inflection. delete_action is required and must be explicitly provided by the caller. */
@@ -368,7 +368,7 @@ export interface RelationHasOneParams {
     source_table_id: string;
     target_table_id: string;
     field_name?: string;
-    delete_action: "c" | "r" | "n" | "d" | "a";
+    delete_action: 'c' | 'r' | 'n' | 'd' | 'a';
     is_required?: boolean;
 }
 /** Creates a foreign key field on the target table referencing the source table. Inverse of RelationBelongsTo — same FK, different perspective. "projects has many tasks" creates tasks.project_id. Auto-derives the FK field name from the source table name using inflection. delete_action is required and must be explicitly provided by the caller. */
@@ -376,7 +376,7 @@ export interface RelationHasManyParams {
     source_table_id: string;
     target_table_id: string;
     field_name?: string;
-    delete_action: "c" | "r" | "n" | "d" | "a";
+    delete_action: 'c' | 'r' | 'n' | 'd' | 'a';
     is_required?: boolean;
 }
 /** Creates a junction table between source and target tables with auto-derived naming and FK fields. The trigger creates a bare table (no implicit DataId), adds FK fields to both tables, optionally creates a composite PK (use_composite_key), then forwards all security config to secure_table_provision as-is. The trigger never injects values the caller did not provide. Junction table FKs always CASCADE on delete. */
@@ -391,15 +391,20 @@ export interface RelationManyToManyParams {
     nodes?: {
         [key: string]: unknown;
     }[];
-    grant_roles?: string[];
-    grant_privileges?: string[][];
-    policy_type?: string;
-    policy_privileges?: string[];
-    policy_role?: string;
-    policy_permissive?: boolean;
-    policy_data?: {
-        [key: string]: unknown;
-    };
+    grants?: {
+        roles: string[];
+        privileges: string[][];
+    }[];
+    policies?: {
+        $type: string;
+        data?: {
+            [key: string]: unknown;
+        };
+        privileges?: string[];
+        policy_role?: string;
+        permissive?: boolean;
+        policy_name?: string;
+    }[];
 }
 /** Declares a spatial predicate between two existing geometry/geography columns. Inserts a metaschema_public.spatial_relation row; the sync_spatial_relation_tags trigger then projects a @spatialRelation smart tag onto the owner column so graphile-postgis' PostgisSpatialRelationsPlugin can expose it as a cross-table filter in GraphQL. Metadata-only: both source_field and target_field must already exist on their tables. Idempotent on (source_table_id, name). One direction per tag — author two RelationSpatial entries if symmetry is desired. */
 export interface RelationSpatialParams {
@@ -408,7 +413,7 @@ export interface RelationSpatialParams {
     target_table_id: string;
     target_field_id: string;
     name: string;
-    operator: "st_contains" | "st_within" | "st_intersects" | "st_covers" | "st_coveredby" | "st_overlaps" | "st_touches" | "st_dwithin";
+    operator: 'st_contains' | 'st_within' | 'st_intersects' | 'st_covers' | 'st_coveredby' | 'st_overlaps' | 'st_touches' | 'st_dwithin';
     param_name?: string;
 }
 /** Simple column selection from a single source table. Projects all or specific fields. */
@@ -433,7 +438,7 @@ export interface ViewJoinedTablesParams {
     primary_columns?: string[];
     joins: {
         table_id: string;
-        join_type?: "INNER" | "LEFT" | "RIGHT" | "FULL";
+        join_type?: 'INNER' | 'LEFT' | 'RIGHT' | 'FULL';
         primary_field: string;
         join_field: string;
         columns?: string[];
@@ -445,7 +450,7 @@ export interface ViewAggregatedParams {
     source_table_id: string;
     group_by_fields: string[];
     aggregates: {
-        function: "COUNT" | "SUM" | "AVG" | "MIN" | "MAX";
+        function: 'COUNT' | 'SUM' | 'AVG' | 'MIN' | 'MAX';
         field?: string;
         alias: string;
     }[];
@@ -472,7 +477,7 @@ export interface BlueprintField {
 /** An RLS policy entry for a blueprint table. Uses $type to match the blueprint JSON convention. */
 export interface BlueprintPolicy {
     /** Authz* policy type name (e.g., "AuthzDirectOwner", "AuthzAllowAll"). */
-    $type: "AuthzDirectOwner" | "AuthzDirectOwnerAny" | "AuthzMembership" | "AuthzEntityMembership" | "AuthzRelatedEntityMembership" | "AuthzOrgHierarchy" | "AuthzTemporal" | "AuthzPublishable" | "AuthzMemberList" | "AuthzRelatedMemberList" | "AuthzAllowAll" | "AuthzDenyAll" | "AuthzComposite" | "AuthzNotReadOnly" | "AuthzPeerOwnership" | "AuthzRelatedPeerOwnership";
+    $type: 'AuthzDirectOwner' | 'AuthzDirectOwnerAny' | 'AuthzMembership' | 'AuthzEntityMembership' | 'AuthzRelatedEntityMembership' | 'AuthzOrgHierarchy' | 'AuthzTemporal' | 'AuthzPublishable' | 'AuthzMemberList' | 'AuthzRelatedMemberList' | 'AuthzAllowAll' | 'AuthzDenyAll' | 'AuthzComposite' | 'AuthzNotReadOnly' | 'AuthzPeerOwnership' | 'AuthzRelatedPeerOwnership';
     /** Privileges this policy applies to (e.g., ["select"], ["insert", "update", "delete"]). */
     privileges?: string[];
     /** Whether this policy is permissive (true) or restrictive (false). Defaults to true. */
@@ -569,6 +574,49 @@ export interface BlueprintTableUniqueConstraint {
     /** Optional schema name override. */
     schema_name?: string;
 }
+/** A storage-specific RLS policy object for apply_storage_security(). Each entry defines an Authz* policy with explicit privileges, scoped to specific storage tables. */
+export interface BlueprintStoragePolicy {
+    /** Authz* policy generator type (e.g., "AuthzPublishable", "AuthzDirectOwner", "AuthzEntityMembership"). */
+    $type: string;
+    /** Privilege array (e.g., ["select", "insert", "update", "delete"]). Intersected with each storage table's supported operations. */
+    privileges: string[];
+    /** Policy data config. Auto-derived from $type when omitted (e.g., AuthzPublishable defaults to {"is_published_field": "is_public", "require_published_at": false}). */
+    data?: Record<string, unknown>;
+    /** Which storage tables to apply this policy to. Defaults to all three when omitted. Uses logical names (not prefixed). */
+    tables?: ('buckets' | 'files' | 'upload_requests')[];
+    /** Custom RLS policy name suffix. Auto-derived from $type when omitted (pub/own/mem). */
+    policy_name?: string;
+}
+/** A bucket seed entry for storage_config.buckets[]. Creates an initial bucket row in the {prefix}_buckets table during entity type provisioning. Only used for app-level storage (not entity-scoped). */
+export interface BlueprintBucketSeed {
+    /** Bucket key name (e.g., "avatars", "documents"). Becomes the key column value. */
+    name: string;
+    /** Human-readable description of this bucket. */
+    description?: string;
+    /** Whether the bucket is publicly readable. Defaults to false. */
+    is_public?: boolean;
+    /** MIME type allowlist (e.g., ["image/png", "image/jpeg"]). NULL means all types allowed. */
+    allowed_mime_types?: string[];
+    /** Maximum file size in bytes for this bucket. NULL means no limit. */
+    max_file_size?: number;
+    /** CORS allowed origins for this bucket. */
+    allowed_origins?: string[];
+}
+/** Storage configuration for an entity type. Controls RLS policies on storage tables, seeds initial buckets, and overrides module-level settings (expiry times, file size limits, CORS). */
+export interface BlueprintStorageConfig {
+    /** Custom RLS policies for storage tables. When provided, replaces the default policy set (AuthzPublishable + membership + AuthzDirectOwner). Each entry is a policy object with $type, privileges, and optional data/tables/policy_name. */
+    policies?: BlueprintStoragePolicy[];
+    /** Initial bucket seed entries. Each creates a row in {prefix}_buckets during provisioning. Only used for app-level storage (not entity-scoped). */
+    buckets?: BlueprintBucketSeed[];
+    /** Override for presigned upload URL expiry time in seconds. */
+    upload_url_expiry_seconds?: number;
+    /** Override for presigned download URL expiry time in seconds. */
+    download_url_expiry_seconds?: number;
+    /** Default maximum file size in bytes for the storage module. */
+    default_max_file_size?: number;
+    /** CORS allowed origins for the storage module. */
+    allowed_origins?: string[];
+}
 /** Override object for the entity table created by a BlueprintMembershipType. Shape mirrors BlueprintTable / secure_table_provision vocabulary. When supplied, policies[] replaces the default entity-table policies entirely. */
 export interface BlueprintEntityTableProvision {
     /** Whether to enable RLS on the entity table. Forwarded to secure_table_provision. Defaults to true. */
@@ -577,10 +625,11 @@ export interface BlueprintEntityTableProvision {
     nodes?: BlueprintNode[];
     /** Custom fields (columns) to add to the entity table. Forwarded to secure_table_provision as-is. */
     fields?: BlueprintField[];
-    /** Privilege grants for the entity table as [verb, columns] tuples (e.g. [["select","*"],["insert","*"]]). Forwarded to secure_table_provision as-is. */
-    grant_privileges?: unknown[];
-    /** Database roles to grant privileges to. Forwarded to secure_table_provision as-is. Defaults to ["authenticated"]. */
-    grant_roles?: string[];
+    /** Unified grant objects for the entity table. Each entry is { roles: string[], privileges: unknown[] } where privileges are [verb, columns] tuples. Forwarded to secure_table_provision as-is. Defaults to []. */
+    grants?: {
+        roles: string[];
+        privileges: unknown[];
+    }[];
     /** RLS policies for the entity table. When present, these policies fully replace the five default entity-table policies (is_visible becomes a no-op). */
     policies?: BlueprintPolicy[];
 }
@@ -604,179 +653,183 @@ export interface BlueprintMembershipType {
     has_profiles?: boolean;
     /** Whether to provision a levels module for this entity type. Defaults to false. */
     has_levels?: boolean;
+    /** Whether to provision a storage module (buckets, files, upload_requests tables) for this entity type. Defaults to false. */
+    has_storage?: boolean;
     /** Escape hatch: when true AND table_provision is NULL, zero policies are provisioned on the entity table. Defaults to false. */
     skip_entity_policies?: boolean;
     /** Override for the entity table. Shape mirrors BlueprintTable / secure_table_provision vocabulary. When supplied, its policies[] replaces the five default entity-table policies; is_visible becomes a no-op. When NULL (default), the five default policies are applied (gated by is_visible). */
     table_provision?: BlueprintEntityTableProvision;
+    /** Storage configuration. Only used when has_storage is true. Controls RLS policies on storage tables, seeds initial buckets, and overrides module-level settings (expiry times, file size limits, CORS). */
+    storage?: BlueprintStorageConfig;
 }
 /** String shorthand -- just the node type name. */
-export type BlueprintNodeShorthand = "AuthzDirectOwner" | "AuthzDirectOwnerAny" | "AuthzMembership" | "AuthzEntityMembership" | "AuthzRelatedEntityMembership" | "AuthzOrgHierarchy" | "AuthzTemporal" | "AuthzPublishable" | "AuthzMemberList" | "AuthzRelatedMemberList" | "AuthzAllowAll" | "AuthzDenyAll" | "AuthzComposite" | "AuthzNotReadOnly" | "AuthzPeerOwnership" | "AuthzRelatedPeerOwnership" | "DataId" | "DataDirectOwner" | "DataEntityMembership" | "DataOwnershipInEntity" | "DataTimestamps" | "DataPeoplestamps" | "DataPublishable" | "DataSoftDelete" | "SearchVector" | "SearchFullText" | "SearchBm25" | "SearchUnified" | "SearchSpatial" | "SearchSpatialAggregate" | "DataJobTrigger" | "DataTags" | "DataStatusField" | "DataJsonb" | "SearchTrgm" | "DataSlug" | "DataInflection" | "DataOwnedFields" | "DataInheritFromParent" | "DataForceCurrentUser" | "DataImmutableFields" | "DataCompositeField" | "TableUserProfiles" | "TableOrganizationSettings" | "TableUserSettings";
+export type BlueprintNodeShorthand = 'AuthzDirectOwner' | 'AuthzDirectOwnerAny' | 'AuthzMembership' | 'AuthzEntityMembership' | 'AuthzRelatedEntityMembership' | 'AuthzOrgHierarchy' | 'AuthzTemporal' | 'AuthzPublishable' | 'AuthzMemberList' | 'AuthzRelatedMemberList' | 'AuthzAllowAll' | 'AuthzDenyAll' | 'AuthzComposite' | 'AuthzNotReadOnly' | 'AuthzPeerOwnership' | 'AuthzRelatedPeerOwnership' | 'DataId' | 'DataDirectOwner' | 'DataEntityMembership' | 'DataOwnershipInEntity' | 'DataTimestamps' | 'DataPeoplestamps' | 'DataPublishable' | 'DataSoftDelete' | 'SearchVector' | 'SearchFullText' | 'SearchBm25' | 'SearchUnified' | 'SearchSpatial' | 'SearchSpatialAggregate' | 'DataJobTrigger' | 'DataTags' | 'DataStatusField' | 'DataJsonb' | 'SearchTrgm' | 'DataSlug' | 'DataInflection' | 'DataOwnedFields' | 'DataInheritFromParent' | 'DataForceCurrentUser' | 'DataImmutableFields' | 'DataCompositeField' | 'TableUserProfiles' | 'TableOrganizationSettings' | 'TableUserSettings';
 /** Object form -- { $type, data } with typed parameters. */
 export type BlueprintNodeObject = {
-    $type: "AuthzDirectOwner";
+    $type: 'AuthzDirectOwner';
     data: AuthzDirectOwnerParams;
 } | {
-    $type: "AuthzDirectOwnerAny";
+    $type: 'AuthzDirectOwnerAny';
     data: AuthzDirectOwnerAnyParams;
 } | {
-    $type: "AuthzMembership";
+    $type: 'AuthzMembership';
     data: AuthzMembershipParams;
 } | {
-    $type: "AuthzEntityMembership";
+    $type: 'AuthzEntityMembership';
     data: AuthzEntityMembershipParams;
 } | {
-    $type: "AuthzRelatedEntityMembership";
+    $type: 'AuthzRelatedEntityMembership';
     data: AuthzRelatedEntityMembershipParams;
 } | {
-    $type: "AuthzOrgHierarchy";
+    $type: 'AuthzOrgHierarchy';
     data: AuthzOrgHierarchyParams;
 } | {
-    $type: "AuthzTemporal";
+    $type: 'AuthzTemporal';
     data: AuthzTemporalParams;
 } | {
-    $type: "AuthzPublishable";
+    $type: 'AuthzPublishable';
     data: AuthzPublishableParams;
 } | {
-    $type: "AuthzMemberList";
+    $type: 'AuthzMemberList';
     data: AuthzMemberListParams;
 } | {
-    $type: "AuthzRelatedMemberList";
+    $type: 'AuthzRelatedMemberList';
     data: AuthzRelatedMemberListParams;
 } | {
-    $type: "AuthzAllowAll";
+    $type: 'AuthzAllowAll';
     data?: Record<string, never>;
 } | {
-    $type: "AuthzDenyAll";
+    $type: 'AuthzDenyAll';
     data?: Record<string, never>;
 } | {
-    $type: "AuthzComposite";
+    $type: 'AuthzComposite';
     data: AuthzCompositeParams;
 } | {
-    $type: "AuthzNotReadOnly";
+    $type: 'AuthzNotReadOnly';
     data: AuthzNotReadOnlyParams;
 } | {
-    $type: "AuthzPeerOwnership";
+    $type: 'AuthzPeerOwnership';
     data: AuthzPeerOwnershipParams;
 } | {
-    $type: "AuthzRelatedPeerOwnership";
+    $type: 'AuthzRelatedPeerOwnership';
     data: AuthzRelatedPeerOwnershipParams;
 } | {
-    $type: "DataId";
+    $type: 'DataId';
     data: DataIdParams;
 } | {
-    $type: "DataDirectOwner";
+    $type: 'DataDirectOwner';
     data: DataDirectOwnerParams;
 } | {
-    $type: "DataEntityMembership";
+    $type: 'DataEntityMembership';
     data: DataEntityMembershipParams;
 } | {
-    $type: "DataOwnershipInEntity";
+    $type: 'DataOwnershipInEntity';
     data: DataOwnershipInEntityParams;
 } | {
-    $type: "DataTimestamps";
+    $type: 'DataTimestamps';
     data: DataTimestampsParams;
 } | {
-    $type: "DataPeoplestamps";
+    $type: 'DataPeoplestamps';
     data: DataPeoplestampsParams;
 } | {
-    $type: "DataPublishable";
+    $type: 'DataPublishable';
     data: DataPublishableParams;
 } | {
-    $type: "DataSoftDelete";
+    $type: 'DataSoftDelete';
     data: DataSoftDeleteParams;
 } | {
-    $type: "SearchVector";
+    $type: 'SearchVector';
     data: SearchVectorParams;
 } | {
-    $type: "SearchFullText";
+    $type: 'SearchFullText';
     data: SearchFullTextParams;
 } | {
-    $type: "SearchBm25";
+    $type: 'SearchBm25';
     data: SearchBm25Params;
 } | {
-    $type: "SearchUnified";
+    $type: 'SearchUnified';
     data: SearchUnifiedParams;
 } | {
-    $type: "SearchSpatial";
+    $type: 'SearchSpatial';
     data: SearchSpatialParams;
 } | {
-    $type: "SearchSpatialAggregate";
+    $type: 'SearchSpatialAggregate';
     data: SearchSpatialAggregateParams;
 } | {
-    $type: "DataJobTrigger";
+    $type: 'DataJobTrigger';
     data: DataJobTriggerParams;
 } | {
-    $type: "DataTags";
+    $type: 'DataTags';
     data: DataTagsParams;
 } | {
-    $type: "DataStatusField";
+    $type: 'DataStatusField';
     data: DataStatusFieldParams;
 } | {
-    $type: "DataJsonb";
+    $type: 'DataJsonb';
     data: DataJsonbParams;
 } | {
-    $type: "SearchTrgm";
+    $type: 'SearchTrgm';
     data: SearchTrgmParams;
 } | {
-    $type: "DataSlug";
+    $type: 'DataSlug';
     data: DataSlugParams;
 } | {
-    $type: "DataInflection";
+    $type: 'DataInflection';
     data: DataInflectionParams;
 } | {
-    $type: "DataOwnedFields";
+    $type: 'DataOwnedFields';
     data: DataOwnedFieldsParams;
 } | {
-    $type: "DataInheritFromParent";
+    $type: 'DataInheritFromParent';
     data: DataInheritFromParentParams;
 } | {
-    $type: "DataForceCurrentUser";
+    $type: 'DataForceCurrentUser';
     data: DataForceCurrentUserParams;
 } | {
-    $type: "DataImmutableFields";
+    $type: 'DataImmutableFields';
     data: DataImmutableFieldsParams;
 } | {
-    $type: "DataCompositeField";
+    $type: 'DataCompositeField';
     data: DataCompositeFieldParams;
 } | {
-    $type: "TableUserProfiles";
+    $type: 'TableUserProfiles';
     data?: Record<string, never>;
 } | {
-    $type: "TableOrganizationSettings";
+    $type: 'TableOrganizationSettings';
     data?: Record<string, never>;
 } | {
-    $type: "TableUserSettings";
+    $type: 'TableUserSettings';
     data?: Record<string, never>;
 };
 /** A node entry in a blueprint table. Either a string shorthand or a typed object. */
 export type BlueprintNode = BlueprintNodeShorthand | BlueprintNodeObject;
 /** A relation entry in a blueprint definition. */
 export type BlueprintRelation = {
-    $type: "RelationBelongsTo";
+    $type: 'RelationBelongsTo';
     source_table: string;
     target_table: string;
     source_schema_name?: string;
     target_schema_name?: string;
 } & Partial<RelationBelongsToParams> | {
-    $type: "RelationHasOne";
+    $type: 'RelationHasOne';
     source_table: string;
     target_table: string;
     source_schema_name?: string;
     target_schema_name?: string;
 } & Partial<RelationHasOneParams> | {
-    $type: "RelationHasMany";
+    $type: 'RelationHasMany';
     source_table: string;
     target_table: string;
     source_schema_name?: string;
     target_schema_name?: string;
 } & Partial<RelationHasManyParams> | {
-    $type: "RelationManyToMany";
+    $type: 'RelationManyToMany';
     source_table: string;
     target_table: string;
     source_schema_name?: string;
     target_schema_name?: string;
 } & Partial<RelationManyToManyParams> | {
-    $type: "RelationSpatial";
+    $type: 'RelationSpatial';
     source_table: string;
     target_table: string;
     source_schema_name?: string;
@@ -796,10 +849,11 @@ export interface BlueprintTable {
     fields?: BlueprintField[];
     /** RLS policies for this table. */
     policies?: BlueprintPolicy[];
-    /** Database roles to grant privileges to. Defaults to ["authenticated"]. */
-    grant_roles?: string[];
-    /** Privilege grants as [verb, column] tuples or objects. Defaults to empty (no grants — callers must explicitly specify). */
-    grants?: unknown[];
+    /** Unified grant objects. Each entry is { roles: string[], privileges: unknown[] } where privileges are [verb, columns] tuples (e.g. [["select","*"]]). Enables per-role targeting. Defaults to []. */
+    grants?: {
+        roles: string[];
+        privileges: unknown[];
+    }[];
     /** Whether to enable RLS on this table. Defaults to true. */
     use_rls?: boolean;
     /** Table-level indexes (table_name inherited from parent). */

package/blueprint-types.generated.js

@@ -1,5 +1,6 @@
 "use strict";
 // GENERATED FILE — DO NOT EDIT
+/* eslint-disable @typescript-eslint/no-empty-object-type */
 //
 // Regenerate with:
 //   cd graphql/node-type-registry && pnpm generate:types