feat: dispatch the hosted /generators/* routes through @supabase/typegen

[spydon]

Closes SDK-1962.

Summary

The hosted /generators/typescript, /generators/go, /generators/python and /generators/swift routes, and the PG_META_GENERATE_TYPES one-shot mode, now dispatch through @supabase/typegen, the language registry behind supabase gen types --lang. postgres-meta no longer imports a generator function by name: the routes are registered for every inProcess language the registry lists, and each language receives the options it declares. When a generator relocates under SDK-1641, postgres-meta follows with a @supabase/typegen bump and no route change.

request  ->  route (one per in-process language)
             |  query parameters -> registry option names, filtered to what the language declares
             |  resolveOptions() -> 400 on a bad value, before touching the database
             |  getGeneratorMetadata() -> introspect() re-exported by the registry
             v
         generateTypes(language, metadata, options)
             |  inline, or on the piscina worker when PG_META_FORMAT_IN_WORKER=true
             v
         language.generate(metadata, options, host)   host = { cwd, env }, no spawn, no format function

What changed

• package.json: @supabase/typegen@0.2.2 replaces @supabase/postgrest-typegen. The pin is exact: a registry release is the one dependency change that alters generated output, so it lands as a deliberate bump with its snapshot update rather than through a range. The registry in turn pins postgrest-typegen 0.4.0 exactly, so the lockfile can only ever hold one version of it. oxfmt becomes a direct dependency, pinned to 0.66.0, the exact optional peer @supabase/typegen and postgrest-typegen declare: npm rejects any other version (npm ls reports it invalid and newer oxfmt releases hit an ERESOLVE through vite-plus), so .github/dependabot.yml ignores it and it moves together with a registry bump. TypeScript is formatted by postgrest-typegen's default formatter, which loads oxfmt as an optional peer, and npm does not install optional peers, which is why the direct dependency exists at all. engines.node is >=22.12.0, which the registry requires and .nvmrc and the Dockerfile already used.
• src/server/routes/generators/index.ts replaces the four per-language route files. Query parameters map onto registry option names: detect_one_to_one_relationships=true is detect-one-to-one-relationships, postgrest_version is postgrest-version, access_control is swift-access-control, and PG_META_GENERATE_TYPES_DEFAULT_SCHEMA is default-schema. declaredOptions in src/lib/generators.ts keeps only what the language declares, so access_control on the Python route stays ignored as before.
• Invalid option values return 400 naming the query parameter and carrying the registry's message, for example access_control=fileprivate. An empty value such as access_control= counts as absent, as before. Before, the value reached the Swift generator unchecked. declaredOptions validates and applies defaults itself, so both the routes and the one-shot mode reject a bad value before opening a database connection, and an empty PG_META_GENERATE_TYPES_SWIFT_ACCESS_CONTROL falls back to internal as before.
• CLAUDE.md describes the registry dispatch, the two previously undocumented environment variables and the worker running every language.
• src/server/format-pool.ts and format-worker.js run language.generate instead of generateTypescript, for every in-process language. With PG_META_FORMAT_IN_WORKER=true all four languages now generate on the worker and count against PG_META_FORMAT_MAX_QUEUE; before, only TypeScript did. The language name and option values are plain data and cross the thread boundary; the worker builds its own Host.
• src/lib/generators.ts drops its sortGeneratorMetadata call. The registry sorts inside generate, and getGeneratorMetadata is not exported from the library entry point.
• src/server/server.ts looks PG_META_GENERATE_TYPES up in the registry and writes the result with process.stdout.write. The registry output ends in the newline console.log used to add, so the one-shot output is byte-identical for Go, Python and Swift.
• swift accepts all four access levels the generator supports (internal, public, private, package), matching what the route accepted before through the unchecked type cast.

Snapshot changes

The inline snapshots in test/server/typegen.ts changed for three reasons, and it is worth telling them apart when reviewing:

1. The postgrest-typegen bump from 0.2.0 (what the lockfile held) to 0.3.1, through the registry pin. The generator fixes in 0.2.1 to 0.2.5 account for most of the diff: zero-argument functions type Args as Record<PropertyKey, never> instead of never, functions returning table or view rows get their Returns expanded, composite arguments on materialized views resolve, Python json columns are JsonValue, and composite attributes are Optional.
2. Go, Python and Swift responses now end in a final newline. Their generators emit it since postgrest-typegen 0.3.1 (SDK-1961, fix(typegen): generators emit the final newline themselves, registry passes it through sdk#233); before, the routes returned the trimmed template verbatim. TypeScript responses are unchanged in this respect: the registry passes a generator's own newline through instead of adding one.
3. The postgrest-typegen bump from 0.3.1 to 0.4.0 (feat(postgrest-typegen): declare computed fields next to Row and type named row parameters without them sdk#243, SDK-1986): every table and view gains ComputedFields, the names of the Row keys that are computed fields, or never; named row parameters of functions are typed Omit<Row, ComputedFields>; and a function named like a column of the relation it takes is no longer added to Row. Today this already lets rpc calls pass a row argument without its computed fields, which master's types demanded; once feat(postgrest): leave computed fields out of select('*') and resolve no-argument rpc overloads for postgrest-typegen output supabase-js#2730 lands, it will also let postgrest-js leave computed fields out of select('*') without inferring them from Functions.

Tests

• test/server/generate-types-mode.ts runs server.ts in PG_META_GENERATE_TYPES mode as a child process: TypeScript output equals the route's body and ends in a single newline, and dart fails before connecting, which the test proves by pointing that run at an unreachable database. The child process clears the settings the route does not read, so a developer's shell cannot make the two outputs differ. The worker pool test covers every in-process language.
• test/types.test.ts loses its pgTypeToTsType case, which imported @supabase/postgrest-typegen directly and only resolved through npm hoisting once the package stopped being declared; it moves to postgrest-typegen's own tests in test(postgrest-typegen): cover the interval to string mapping sdk#235 (SDK-1972). No postgrest-typegen import remains in this repository.
• test/server/format-pool.ts compares the worker path against typescript.generate from the registry instead of generateTypescript.
• test/server/typegen.ts adds: access_control=private and package produce Swift with that level, an unknown level returns 400 with Query parameter "access_control" is invalid: followed by the registry's message, an empty access_control= falls back to internal, and a route exists for every in-process registry language and for no other, so /generators/dart has none.
• npm run check, prettier, and the full suite pass locally; the lockfile installs with npm clean-install without any peer-dependency flag.

[avallete]

I dogfooded and reviewed this at bc030db. It works well. The one thing I'd like changed before merge is the oxfmt range and the text around it (inline comments below).

What I checked

• npm ci, npm run check, npm run build, and the full suite (199/199) all pass.
• The generated TS compiles under tsc --strict. A consumer on @supabase/supabase-js / postgrest-js 2.117.2 compiles too, using select('*'), joins, rpc, insert and update.
• Omit<Row, ComputedFields> is a real improvement. rpc('function_returning_single_row', { todos: { id, details, 'user-id' } }) fails to compile against master's types, because they require every computed field. It compiles here. Passing a computed key is still accepted.
• PG_META_FORMAT_IN_WORKER=true and inline generation give byte-identical output for typescript, go, python and swift.
• In one-shot mode, PG_META_GENERATE_TYPES=dart and an invalid swift access level both fail before a DB connection is attempted.
• npm pack ships typegen-host.js and format-worker.js.

Non-blocking

• PR body, snapshot reason 3: "This is what lets postgrest-js leave computed fields out of select('*')". Published postgrest-js doesn't read ComputedFields yet (supabase/supabase-js#2730 is still open), so select('*') result types don't change with this PR. Maybe say "will let", and mention the rpc row-argument improvement instead.
• apps/cli still pins @supabase/typegen 0.2.1. Once this deploys, supabase gen types --local and --linked output will differ by the ComputedFields / Omit lines until the CLI bumps to 0.2.2.
• src/server/format-pool.ts:31 still says "Formatting generated types timed out", but it now covers go, python and swift too. Something like "Generating types timed out" would fit better.
• An empty access_control= now returns 400. On master it produced Swift with no modifier, which means internal. That's probably fine, but it is a small behavior change for the hosted route.
• Test gaps: nothing covers the one-shot mode in server.ts (including the TS output now ending in one newline instead of two), and the worker test is TS-only. The /generators/dart 404 test also passes on master, so it doesn't really guard the inProcess filter.

[spydon]

Thanks for the thorough review @avallete!
I'm waiting for supabase/cli#6919 to be merged and released, once that is done then supabase/supabase-js#2730 can move forward.
Fixing up the other things now.

[avallete]

Thanks @spydon, the follow-ups cover everything from my last review. I re-dogfooded at a0f3016 and it looks good, so approving. The inline notes are all non-blocking.

What I checked

• npm ci works without flags, and npm ls oxfmt is clean with the exact pin. Check, prettier and build pass, and the full suite passes (203/203).
• TypeScript, Go, Python and Swift output is byte-identical to bc030db, which still had the custom formatter. I compared inline generation, PG_META_FORMAT_IN_WORKER=true, the server started from an unrelated cwd, an npm pack install, and the Docker image. So the default formatter resolves oxfmt correctly everywhere.
• An empty access_control= now returns 200 with internal. fileprivate returns 400 with the new Query parameter "access_control" is invalid: prefix. The python route still ignores access_control.
• One-shot output matches the routes and ends in a single newline. dart and fileprivate exit 1 before connecting, even with the DB pointed at port 1.

PR body (non-blocking)

• The --legacy-peer-deps note is stale: a fresh resolve at oxfmt 0.66.0 works without it.
• The Tests section still describes the old 400 message and the dart-only 404 test. It doesn't list the new registry-driven route test or the empty access_control test.
• In the diagram, no format reads as if TypeScript is no longer formatted. It's only that the host passes no format function.

Outside this PR: apps/cli still pins @supabase/typegen 0.2.1. Until it moves to 0.2.2, --local and --linked TypeScript output will differ by the ComputedFields / Omit lines.

[spydon]

Thanks for the review @avallete, fixed all the nits too!