feat: add six capabilities the registry was missing

[spydon]

Adds six capability ids across two areas, plus one new group.

These came out of backfilling supabase-flutter's sdk-compliance.yaml against its full public API (supabase-flutter#1673). Reaching 100% coverage meant every public symbol needed a home, which made it obvious which operations the registry has no id for. Each one below is a gap in the registry's own symmetry rather than a Dart-shaped request: in every case a sibling area already has the equivalent capability.

storage.analytics.access_catalog

storage.file_buckets.access_bucket ("Scope subsequent file operations to a specific bucket") and storage.vector_buckets.access_vector_index ("Scope subsequent vector operations to a specific index within a bucket") both exist.

Analytics has seventeen operations across namespaces and tables, and no id for the handle you need before you can call any of them. Worth noting the asymmetry is recent: #74 and #76 filled in the analytics operations without adding the accessor the other two groups have.

auth.passkey.list_passkeys, update_passkey, delete_passkey

auth.passkey_admin.list_passkeys and auth.passkey_admin.delete_passkey already cover an admin enumerating and revoking a user's passkeys. There was nothing for a user managing their own credentials, which is the more common flow of the two, and no id at all for renaming one.

update_passkey is described narrowly (mutable metadata, such as the friendly name) since the credential itself is immutable.

storage.file_buckets.request_cancellation and storage.configuration.auto_retry

database.using_modifiers.request_cancellation and functions.invocation.request_cancellation both exist, as does database.configuration.auto_retry.

Storage was the one area with retry and abort behaviour and no id for either, which is arguably backwards: aborting a multi-megabyte upload is more user-visible than aborting a query. auto_retry needs a new configuration group in the storage area, matching the group of the same name in database.

What I deliberately left out

Four gaps surfaced in the same audit that I do not think belong here:

• Client disposal (Supabase.instance.dispose). This started out in the PR as client.lifecycle.dispose and has been dropped following review. Two reasons. First, the id was not adjudicable: it needed an escape hatch so garbage-collected runtimes could declare not_applicable, but process termination releases resources on every runtime, so there was no observable test separating "reclaims automatically" from "implemented". Second, the teardown surface a caller can actually see is already registered, via realtime.client.disconnect, realtime.client.remove_all_channels and realtime.channel.unsubscribe. A whole-client dispose is largely the aggregate of those plus internal timers and connection pooling, so its presence or absence says little about parity that the existing ids do not already say. Releasing resources idiomatically is a baseline every SDK owes its framework rather than a feature it can lack.
• Client construction (Supabase.initialize, instance, isInitialized). Every SDK has it, but it is the precondition for the whole matrix rather than a feature within it.
• Table streams as a database capability (SupabaseQueryBuilder.stream). This one is a genuine inconsistency, but possibly on the Dart side. The registry already carries the modifiers of this capability, since supabase-flutter registers SupabaseStreamFilterBuilder.eq under database.using_filters.eq and SupabaseStreamBuilder.order under database.using_modifiers.order, yet there is no id for the operation those modify. supabase-js has no direct equivalent (you compose a channel with postgres changes by hand), so this may be Dart sugar that should be attributed differently rather than a missing id. Raising it as a question rather than proposing an id.
• Typed row mapping (withConverter). The Dart idiom for what TypeScript does with generics, so not a cross-SDK capability.

Compliance impact

None of these is breaking. No id is renamed and no existing entry changes, so every SDK's sdk-compliance.yaml keeps validating; the six new ids simply default to not_implemented until an SDK declares them.

supabase-flutter implements all six and will declare them in a follow-up, which moves the corresponding symbols out of its generic top-level supporting_symbols list into the features they actually belong to. Its disposal symbols stay in supporting_symbols, which is where they already are today.

Test plan

• npm run validate: OK — capability matrix is valid.
• npm test: 195 passed across 14 files.
• npm run typecheck: clean.
• Confirmed against capabilities/*.yaml that none of the six ids already exists under another name, and that the new storage.configuration group is new.
• Confirmed capabilities/client.yaml is byte-identical to main after dropping the disposal id.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a6d7b8df-3c22-4ecb-9e87-6189beed778c

📥 Commits

Reviewing files that changed from the base of the PR and between c73e9fa and 4961855.

📒 Files selected for processing (3)

• capabilities/auth.yaml
• capabilities/client.yaml
• capabilities/storage.yaml

---

📝 Walkthrough

Summary by CodeRabbit

• New Features
  • Added user-scoped passkey management for listing, updating metadata, and deleting passkeys without administrator access.
  • Added client lifecycle controls for deterministic cleanup of connections, timers, workers, and pooled HTTP resources.
  • Added storage configuration capabilities for Iceberg catalog access, request cancellation, and automatic retries.

Walkthrough

The change adds capability declarations in three areas. Authentication now supports user-scoped passkey listing, metadata updates, and deletion. Client capabilities now document lifecycle configuration and deterministic resource disposal. Storage capabilities now include Iceberg catalog access, cancellation of in-flight requests, and automatic retry configuration.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}