feat(storage): add the five missing Iceberg catalog capabilities - #76
Merged
Conversation
The Iceberg namespace and table splits cover create, list, load, update,
rename and delete, but the Iceberg REST Catalog exposes five more
operations that no feature id currently describes:
- GET /namespaces/{ns} load_namespace_metadata
- HEAD /namespaces/{ns} namespace_exists
- POST /namespaces/{ns}/properties update_namespace_properties
- POST /namespaces/{ns}/register register_table
- HEAD /namespaces/{ns}/tables/{t} table_exists
supabase-flutter implements all five today and has nowhere to declare
them, so they end up registered against a capability they do not
implement purely to satisfy the new-symbol check.
|
Warning Review limit reached
Next review available in: 59 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
spydon
added a commit
to supabase/supabase-flutter
that referenced
this pull request
Aug 7, 2026
Every Iceberg catalog operation now has a feature id, so loadNamespaceMetadata, namespaceExists, updateNamespaceProperties, registerTable and tableExists move out of the top-level supporting bucket into entries of their own. That also gives RegisterTableRequest and UpdateNamespacePropertiesResult a real owner, leaving nothing at the top level but genuinely shared types.
grdsdev
approved these changes
Aug 7, 2026
5 tasks
spydon
marked this pull request as ready for review
August 7, 2026 09:53
spydon
added a commit
to supabase/supabase-flutter
that referenced
this pull request
Aug 7, 2026
…nd splits (#1667) ## Summary Reconciles `sdk-compliance.yaml` with three upstream changes that have now landed in `supabase/sdk`: - **supabase/sdk#74** renamed and split several canonical feature IDs. - **supabase/sdk#75** separated symbol *evidence* from symbol *coverage*, adding `supporting_symbols`. - **supabase/sdk#76** added the five Iceberg catalog capabilities that #74's split left without an ID. ### Renames and merges - `auth.sign_in.reset_password` → `auth.sign_in.send_password_reset_email` - `realtime.channel.send` → `realtime.channel.broadcast` - `storage.file_buckets.list_files_paginated` merged into `list_files` - `storage.analytics.iceberg_namespace` split into `create_namespace` / `list_namespaces` / `delete_namespace` - `storage.analytics.iceberg_table` split into `create_table` / `list_tables` / `load_table` / `update_table` / `rename_table` / `delete_table` ### New capabilities declared `load_namespace_metadata`, `namespace_exists`, `update_namespace_properties`, `register_table`, `table_exists`. ## Why the Iceberg entries look the way they do Splitting two bundled entries into fifteen raises the question of which symbols belong where. The Iceberg surface is 352 symbols, only 18 of which are catalog entry points; the rest are option types, result types, the schema and type model, and the exception hierarchy. `symbols` now holds **only** the methods a caller invokes, because the drift check treats every name in it as evidence the capability exists. Everything else sits under `supporting_symbols`, which counts for new-symbol coverage without claiming to implement anything. Owners for the supporting types are derived from the source rather than assigned by hand: build the type graph from `packages/storage_client/lib/src/iceberg/`, including subtype edges since a signature naming a sealed base reaches every variant a caller can pass, then ask which entry points reach each type. A type reachable from exactly one feature belongs to that feature. | | count | |---|---| | Sole natural owner | 37 of 67 | | Genuinely shared across several features | 20 | | Reachable from no entry point (thrown, not passed) | 10 | So all 28 `*Update` and `Assert*` classes land on `update_table`, `ListTablesOptions`/`ListTablesResult` on `list_tables`, `RegisterTableRequest` on `register_table`. The schema and type model and the exception hierarchy stay in the top-level `supporting_symbols` list, which is the honest answer rather than a coin flip. The alternative was to replicate the full 330-symbol list across all six table IDs and the 22-symbol list across all three namespace IDs (+1729 lines, as in the now-closed #1666). That inflates what the file claims is implemented, fans drift findings across features that do not own the symbol, and leaves attribution arbitrary, since `buildSymbolIndex` last-wins on collision. Under that shape only 2 of 9 split features resolved to their own entry point; here it is 9 of 9. ## Test plan Validated against current `supabase/sdk@main`, with #74, #75 and #76 all merged: - [x] `validate-compliance`: `OK — compliance file is valid.` Two features remain undeclared (`postgres_changes_multiple_filters`, `error_codes`); both are pre-existing and out of scope here. - [x] `check-drift` against symbols extracted with the real Dart extractor: `✅ No capability matrix drift detected.` - [x] `check-api-symbols`: all public API accounted for; 887 symbols covered, unchanged from before this PR. - [x] Verified no unintended edits: every feature outside the rename and split scope is byte-identical to `main` after re-serialization. - [x] CI re-run after the upstream merges: `Validate compliance file` and `Check public API against capability matrix` both green. No SDK code changes, only capability declarations. Context: [SDK-1439](https://linear.app/supabase/issue/SDK-1439) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Improvements** * Standardized capability names for password reset and realtime broadcast functionality. * Clarified storage file listing capabilities, including pagination and sorting support. * Added more granular capability definitions for Iceberg namespaces and tables. * Consolidated shared Iceberg models, errors, catalog access, and supporting symbols for more consistent capability descriptions. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
5 tasks
grdsdev
pushed a commit
that referenced
this pull request
Aug 12, 2026
🤖 I have created a release *beep* *boop* --- ## [1.0.0](v1.0.0...v1.0.0) (2026-08-12) ### ⚠ BREAKING CHANGES * reconcile capability matrix inconsistencies from skill audit ([#74](#74)) ### Features * add capabilities based on supabase-js public methods ([#19](#19)) ([8b07e38](8b07e38)) * add capability-matrix maintenance skill ([#73](#73)) ([070e2c9](070e2c9)) * add review-spec and review-spec-compliance skills ([#6](#6)) ([b2646c1](b2646c1)) * add SDK implementation status matrix to README and skill ([#4](#4)) ([753f06c](753f06c)) * **api-check:** include file path and line number in compliance failure messages ([#45](#45)) ([2f4be47](2f4be47)) * **auth:** add sign-out reason capability ([#47](#47)) ([51a3abd](51a3abd)) * canonical SDK capability matrix ([#8](#8)) ([215bc3e](215bc3e)) * **capability-matrix:** strict cross-SDK parity score + coverage scope ([#63](#63)) ([de1abe1](de1abe1)) * CI check 1 — block PRs adding public API not in capability matrix ([#31](#31)) ([293440c](293440c)) * **compliance:** list undeclared features after validation ([#48](#48)) ([29f396a](29f396a)) * **compliance:** list undeclared features as notes after validation ([29f396a](29f396a)) * **compliance:** split symbol evidence from symbol coverage ([#75](#75)) ([abc8e71](abc8e71)) * initial SDK specs, skills, and install script ([e662b17](e662b17)) * move SDK compliance to per-repo files ([#15](#15)) ([4d32675](4d32675)) * **parsers:** add Dart public API parser via package:analyzer (alternative to [#35](#35)) ([#41](#41)) ([e3ba07a](e3ba07a)) * **parsers:** add griffe-based Python public API surface parser ([#36](#36)) ([c44f836](c44f836)) * **parsers:** replace Swift regex parser with swift-symbolgraph-extract ([#38](#38)) ([80529a7](80529a7)) * **realtime:** add multiple postgres_changes filters capability ([#70](#70)) ([825ab0c](825ab0c)) * reconcile capability matrix inconsistencies from skill audit ([#74](#74)) ([9c53a70](9c53a70)) * rename sdk-parse-ignore to .sdk-parse-ignore ([#37](#37)) ([4f4ab61](4f4ab61)) * render symbol names as clickable links in capability matrix ([#14](#14)) ([dcaf122](dcaf122)) * show feature description as visible sub-text in capability matrix ([#13](#13)) ([3a750ab](3a750ab)) * **site:** serve compliance.json with precomputed parity from GitHub Pages ([#46](#46)) ([0d9106c](0d9106c)) * **storage:** add purge_cache and purge_bucket_cache canonical capabilities ([#44](#44)) ([9a6f864](9a6f864)) * **storage:** add storage.errors.error_codes capability ([#71](#71)) ([fabb9a7](fabb9a7)) * **storage:** add the five missing Iceberg catalog capabilities ([#76](#76)) ([c3c8f9e](c3c8f9e)) ### Bug Fixes * **aggregate:** point csharp and go SDKs at correct repo slugs ([#62](#62)) ([8b7320f](8b7320f)) * **aggregate:** point kotlin SDK at supabase-community/supabase-kt ([#61](#61)) ([b1a99e9](b1a99e9)) * **capability-matrix:** correct coverage scope metric description ([#64](#64)) ([5daeaf5](5daeaf5)) * **ci:** repair python pipeline and simplify sdk-compliance workflow ([#42](#42)) ([2140f44](2140f44)) * **ci:** use nx to run docs:json so workspace deps are built first ([#56](#56)) ([9b449bb](9b449bb)) * **dart-extractor:** exclude [@internal-annotated](https://github.com/internal-annotated) symbols from the public API surface ([9bd358e](9bd358e)) * **dart-extractor:** exclude [@internal](https://github.com/internal) symbols from the public API surface ([#54](#54)) ([9bd358e](9bd358e)) * remove broken sticky thead, add scroll-margin-top and group-row borders ([#10](#10)) ([68761cd](68761cd)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: supabase-releaser[bot] <223506987+supabase-releaser[bot]@users.noreply.github.com>
spydon
added a commit
that referenced
this pull request
Aug 14, 2026
Adds six capability ids across two areas, plus one new group. These came out of backfilling supabase-flutter's `sdk-compliance.yaml` against its full public API ([supabase-flutter#1673](supabase/supabase-flutter#1673)). Reaching 100% coverage meant every public symbol needed a home, which made it obvious which operations the registry has no id for. Each one below is a gap in the registry's own symmetry rather than a Dart-shaped request: in every case a sibling area already has the equivalent capability. ## `storage.analytics.access_catalog` `storage.file_buckets.access_bucket` ("Scope subsequent file operations to a specific bucket") and `storage.vector_buckets.access_vector_index` ("Scope subsequent vector operations to a specific index within a bucket") both exist. Analytics has seventeen operations across namespaces and tables, and no id for the handle you need before you can call any of them. Worth noting the asymmetry is recent: #74 and #76 filled in the analytics operations without adding the accessor the other two groups have. ## `auth.passkey.list_passkeys`, `update_passkey`, `delete_passkey` `auth.passkey_admin.list_passkeys` and `auth.passkey_admin.delete_passkey` already cover an admin enumerating and revoking a user's passkeys. There was nothing for a user managing their own credentials, which is the more common flow of the two, and no id at all for renaming one. `update_passkey` is described narrowly (mutable metadata, such as the friendly name) since the credential itself is immutable. ## `storage.file_buckets.request_cancellation` and `storage.configuration.auto_retry` `database.using_modifiers.request_cancellation` and `functions.invocation.request_cancellation` both exist, as does `database.configuration.auto_retry`. Storage was the one area with retry and abort behaviour and no id for either, which is arguably backwards: aborting a multi-megabyte upload is more user-visible than aborting a query. `auto_retry` needs a new `configuration` group in the storage area, matching the group of the same name in database. ## What I deliberately left out Four gaps surfaced in the same audit that I do **not** think belong here: - **Client disposal** (`Supabase.instance.dispose`). This started out in the PR as `client.lifecycle.dispose` and has been dropped following [review](#78 (comment)). Two reasons. First, the id was not adjudicable: it needed an escape hatch so garbage-collected runtimes could declare `not_applicable`, but process termination releases resources on every runtime, so there was no observable test separating "reclaims automatically" from "implemented". Second, the teardown surface a caller can actually see is already registered, via `realtime.client.disconnect`, `realtime.client.remove_all_channels` and `realtime.channel.unsubscribe`. A whole-client `dispose` is largely the aggregate of those plus internal timers and connection pooling, so its presence or absence says little about parity that the existing ids do not already say. Releasing resources idiomatically is a baseline every SDK owes its framework rather than a feature it can lack. - **Client construction** (`Supabase.initialize`, `instance`, `isInitialized`). Every SDK has it, but it is the precondition for the whole matrix rather than a feature within it. - **Table streams as a database capability** (`SupabaseQueryBuilder.stream`). This one is a genuine inconsistency, but possibly on the Dart side. The registry already carries the *modifiers* of this capability, since supabase-flutter registers `SupabaseStreamFilterBuilder.eq` under `database.using_filters.eq` and `SupabaseStreamBuilder.order` under `database.using_modifiers.order`, yet there is no id for the operation those modify. supabase-js has no direct equivalent (you compose a channel with postgres changes by hand), so this may be Dart sugar that should be attributed differently rather than a missing id. Raising it as a question rather than proposing an id. - **Typed row mapping** (`withConverter`). The Dart idiom for what TypeScript does with generics, so not a cross-SDK capability. ## Compliance impact None of these is breaking. No id is renamed and no existing entry changes, so every SDK's `sdk-compliance.yaml` keeps validating; the six new ids simply default to `not_implemented` until an SDK declares them. supabase-flutter implements all six and will declare them in a follow-up, which moves the corresponding symbols out of its generic top-level `supporting_symbols` list into the features they actually belong to. Its disposal symbols stay in `supporting_symbols`, which is where they already are today. ## Test plan - [x] `npm run validate`: `OK — capability matrix is valid.` - [x] `npm test`: 195 passed across 14 files. - [x] `npm run typecheck`: clean. - [x] Confirmed against `capabilities/*.yaml` that none of the six ids already exists under another name, and that the new `storage.configuration` group is new. - [x] Confirmed `capabilities/client.yaml` is byte-identical to `main` after dropping the disposal id.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
#74 splits the two bundled Iceberg entries into nine per-operation feature IDs: create, list and delete for namespaces; create, list, load, update, rename and delete for tables.
The Iceberg REST Catalog exposes five more operations that no feature ID describes:
GET /namespaces/{ns}storage.analytics.load_namespace_metadataHEAD /namespaces/{ns}storage.analytics.namespace_existsPOST /namespaces/{ns}/propertiesstorage.analytics.update_namespace_propertiesPOST /namespaces/{ns}/registerstorage.analytics.register_tableHEAD /namespaces/{ns}/tables/{table}storage.analytics.table_existsThis is not theoretical. supabase-flutter implements all five today:
Because
check-api-symbolsrequires every public symbol to be registered somewhere, and there is no ID that fits, those methods currently have to be declared against a capability they do not implement just to keep CI green. That is visible in supabase/supabase-flutter#1666, where the whole Iceberg symbol list is replicated across every split ID, and in supabase/supabase-flutter#1667, where they sit in a supporting bucket with a comment explaining they have no home.Splitting a bundled capability into per-verb IDs is only lossless if the verbs cover the surface. These five are the gap.
Change
Adds the five feature IDs to
capabilities/storage.yaml, in the existinganalyticsgroup, following the descriptions already used for the split entries.No SDK currently declares anything under
storage.analytics, so every SDK except Flutter is unaffected. They staynot_implementedby omission, which is accurate.Test plan
npm run validate:OK — capability matrix is valid.storage.analyticscapabilities, so nothing regresses there.Related