better-supabase 0.1.0 → 0.2.0

package/dist/client/index.d.ts

@@ -1,2 +1,2 @@
-import { a as BrowserOptions, i as BrowserAuth, n as AuthUser, o as createBrowser, r as BetterBrowser, t as AuthSnapshot } from "../index-Sw43J8HG.js";
+import { a as BrowserOptions, i as BrowserAuth, n as AuthUser, o as createBrowser, r as BetterBrowser, t as AuthSnapshot } from "../index-D4v7sncu.js";
 export { AuthSnapshot, AuthUser, BetterBrowser, BrowserAuth, BrowserOptions, createBrowser };

package/dist/{compiler-DL18ukPe.d.ts → compiler-CZ9nIuqy.d.ts}

@@ -1,5 +1,5 @@
-import { g as Operation } from "./executor-Bazhgsgq.js";
-import { i as PostgrestPlan } from "./postgrest-Dm-vhY6R.js";
+import { g as Operation } from "./executor-CGdNQ27g.js";
+import { i as PostgrestPlan } from "./postgrest-cAEQ_IQN.js";
 //#region src/core/compiler.d.ts
 /**
  * Turns an IR operation into something a backend runs. An `Executor` for a

package/dist/config/index.d.ts

@@ -1,3 +1,3 @@
-import { A as resolveConfig, C as SqlConfig, D as VectorDistance, E as TimestampsConfig, F as valibot, I as JsonSchemaGeneratorOptions, L as buildJsonSchema, M as ZodGeneratorOptions, N as zod, O as VectorSearchConfig, P as ValibotGeneratorOptions, R as jsonSchema, S as SourceConfig, T as TenantConfig, _ as RealtimeConfig, a as CodecsConfig, b as SeedConfig, c as ExposeConfig, d as GeneratorInput, f as JsonSchemaSource, g as Privilege, h as PluginFlagsConfig, i as CONFIG_SCHEMA_URL, j as resolveJsonSchema, k as defineConfig, l as GeneratedFile, m as OpenApiConfig, n as BetterSupabaseConfig, o as DoctorConfig, p as JsonTypeConfig, r as BucketConfig, s as EntitlementsConfig, t as ActorConfig, u as Generator, v as ResolvedConfig, w as TableConfig, x as SoftDeleteConfig, y as ResolvedExpose } from "../index-BD6wKthp.js";
-import { i as Casing } from "../types-C2fslP1z.js";
-export { ActorConfig, BetterSupabaseConfig, BucketConfig, CONFIG_SCHEMA_URL, type Casing, CodecsConfig, DoctorConfig, EntitlementsConfig, ExposeConfig, GeneratedFile, Generator, GeneratorInput, type JsonSchemaGeneratorOptions, JsonSchemaSource, JsonTypeConfig, OpenApiConfig, PluginFlagsConfig, Privilege, RealtimeConfig, ResolvedConfig, ResolvedExpose, SeedConfig, SoftDeleteConfig, SourceConfig, SqlConfig, TableConfig, TenantConfig, TimestampsConfig, type ValibotGeneratorOptions, VectorDistance, VectorSearchConfig, type ZodGeneratorOptions, buildJsonSchema, defineConfig, jsonSchema, resolveConfig, resolveJsonSchema, valibot, zod };
+import { A as defineConfig, C as SourceConfig, D as TimestampsConfig, E as TenantConfig, F as ValibotGeneratorOptions, I as valibot, L as JsonSchemaGeneratorOptions, M as resolveJsonSchema, N as ZodGeneratorOptions, O as VectorDistance, P as zod, R as buildJsonSchema, S as SoftDeleteConfig, T as TableConfig, _ as Privilege, a as ClaimsConfig, b as ResolvedExpose, c as EntitlementsConfig, d as Generator, f as GeneratorInput, g as PluginFlagsConfig, h as OpenApiConfig, i as CONFIG_SCHEMA_URL, j as resolveConfig, k as VectorSearchConfig, l as ExposeConfig, m as JsonTypeConfig, n as BetterSupabaseConfig, o as CodecsConfig, p as JsonSchemaSource, r as BucketConfig, s as DoctorConfig, t as ActorConfig, u as GeneratedFile, v as RealtimeConfig, w as SqlConfig, x as SeedConfig, y as ResolvedConfig, z as jsonSchema } from "../index-DOsjFvMf.js";
+import { a as Casing } from "../types-C83v5SQz.js";
+export { ActorConfig, BetterSupabaseConfig, BucketConfig, CONFIG_SCHEMA_URL, type Casing, ClaimsConfig, CodecsConfig, DoctorConfig, EntitlementsConfig, ExposeConfig, GeneratedFile, Generator, GeneratorInput, type JsonSchemaGeneratorOptions, JsonSchemaSource, JsonTypeConfig, OpenApiConfig, PluginFlagsConfig, Privilege, RealtimeConfig, ResolvedConfig, ResolvedExpose, SeedConfig, SoftDeleteConfig, SourceConfig, SqlConfig, TableConfig, TenantConfig, TimestampsConfig, type ValibotGeneratorOptions, VectorDistance, VectorSearchConfig, type ZodGeneratorOptions, buildJsonSchema, defineConfig, jsonSchema, resolveConfig, resolveJsonSchema, valibot, zod };

package/dist/config/index.js

@@ -1,3 +1,3 @@
-import { n as jsonSchema, t as buildJsonSchema } from "../json-schema-BbwO2mZg.js";
-import { a as zod, i as resolveJsonSchema, n as defineConfig, o as valibot, r as resolveConfig, t as CONFIG_SCHEMA_URL } from "../config-D-aR2ZoN.js";
+import { n as jsonSchema, t as buildJsonSchema } from "../json-schema-BpYqkCKf.js";
+import { a as zod, i as resolveJsonSchema, n as defineConfig, o as valibot, r as resolveConfig, t as CONFIG_SCHEMA_URL } from "../config-ClDXmVtY.js";
 export { CONFIG_SCHEMA_URL, buildJsonSchema, defineConfig, jsonSchema, resolveConfig, resolveJsonSchema, valibot, zod };

package/dist/{config-D-aR2ZoN.js → config-ClDXmVtY.js}

@@ -1,4 +1,5 @@
-import { a as parseImport, c as schemaName, d as variantsFor, i as fieldsFor, l as siblingPath, o as propertyKey, r as HEADER, s as rowType, u as tableEntries } from "./json-schema-BbwO2mZg.js";
+import { t as DEFAULT_CLAIMS } from "./claims-CoTobNC-.js";
+import { a as parseImport, c as schemaName, d as variantsFor, i as fieldsFor, l as siblingPath, o as propertyKey, r as HEADER, s as rowType, u as tableEntries } from "./json-schema-BpYqkCKf.js";
 //#region src/generators/valibot.ts
 function scalar$1(kind) {
 	switch (kind.kind) {
@@ -18,8 +19,7 @@ function scalar$1(kind) {
 	}
 }
 function field$1(table, plan, jsonImports) {
-	const imported = jsonImports.get(`${table}.${plan.column.db}`);
-	let expr = imported ? imported : plan.customJson ? `v.custom<NonNullable<RowOf<'${table}'>['${plan.name}']>>((value) => value !== undefined)` : plan.column.storage !== void 0 ? `(v.string() as unknown as v.GenericSchema<${rowType(table, plan)}>)` : scalar$1(plan.scalar);
+	let expr = jsonImports.get(`${table}.${plan.column.db}`) ?? (plan.customJson ? `v.custom<NonNullable<RowOf<'${table}'>['${plan.name}']>>((value) => value !== undefined)` : plan.column.storage !== void 0 ? `(v.string() as unknown as v.GenericSchema<${rowType(table, plan)}>)` : scalar$1(plan.scalar));
 	if (plan.column.array) expr = `v.array(${expr})`;
 	if (plan.nullable) expr = `v.nullable(${expr})`;
 	if (plan.optional) expr = `v.exactOptional(${expr})`;
@@ -96,8 +96,7 @@ function scalar(kind) {
 	}
 }
 function field(table, plan, jsonImports) {
-	const imported = jsonImports.get(`${table}.${plan.column.db}`);
-	let expr = imported ? imported : plan.customJson ? `z.custom<NonNullable<RowOf<'${table}'>['${plan.name}']>>((value) => value !== undefined)` : plan.column.storage !== void 0 ? `(z.string() as unknown as z.ZodType<${rowType(table, plan)}>)` : scalar(plan.scalar);
+	let expr = jsonImports.get(`${table}.${plan.column.db}`) ?? (plan.customJson ? `z.custom<NonNullable<RowOf<'${table}'>['${plan.name}']>>((value) => value !== undefined)` : plan.column.storage !== void 0 ? `(z.string() as unknown as z.ZodType<${rowType(table, plan)}>)` : scalar(plan.scalar));
 	if (plan.column.array) expr = `z.array(${expr})`;
 	if (plan.nullable) expr = `${expr}.nullable()`;
 	if (plan.optional) expr = `${expr}.exactOptional()`;
@@ -236,15 +235,16 @@ function resolveConfig(config, root) {
 				updatedAt: "updated_at"
 			}),
 			softDelete: pick(config.plugins?.softDelete, { column: "deleted_at" }),
-			tenant: pick(config.plugins?.tenant, {
-				column: "organization_id",
-				claim: "org_id"
-			}),
+			tenant: pick(config.plugins?.tenant, { column: "organization_id" }),
 			actor: pick(config.plugins?.actor, {
 				createdBy: "created_by",
 				updatedBy: "updated_by"
 			})
 		},
+		claims: {
+			...DEFAULT_CLAIMS,
+			...config.claims
+		},
 		buckets: config.buckets ?? {},
 		topics: config.topics ?? {},
 		realtime: { tables: config.realtime?.tables ?? [] },
@@ -268,7 +268,8 @@ function resolveConfig(config, root) {
 			ignore: config.doctor?.ignore ?? [],
 			strict: config.doctor?.strict ?? false,
 			sources: config.doctor?.sources ?? ["src/**/*.{ts,tsx}"],
-			policyHelperLimit: config.doctor?.policyHelperLimit ?? 5
+			policyHelperLimit: config.doctor?.policyHelperLimit ?? 5,
+			...config.doctor?.claimsLimit === void 0 ? {} : { claimsLimit: config.doctor.claimsLimit }
 		}
 	};
 }

package/dist/{define-QGkq04oe.js → define-BXMYD9AY.js}

@@ -1,11 +1,12 @@
 import { n as dbError, t as DbException } from "./errors-Bl3rkOzo.js";
-import { a as invalidRequest, c as needsDecoding, o as decodeRows, r as IrBuilder, s as encodeValue } from "./simplify-oHiDKRVQ.js";
+import { a as invalidRequest, c as needsDecoding, o as decodeRows, r as IrBuilder, s as encodeValue } from "./simplify-bwJpLnaS.js";
 import { i as or, t as and } from "./types-6cYK9pbJ.js";
 import { i as ok, n as err, o as toDbError, s as withErrorMapper, t as AsyncResult } from "./result-DWXatkd6.js";
 import { t as invalidationTargets } from "./tables-rZxRxNPW.js";
+import { t as consoleLogger } from "./logger-glM28NVN.js";
 import { r as orderPlugins } from "./plugin-BqR6wKMB.js";
-import { a as postgrestExecutor, n as StatsRecorder, r as recordStats } from "./stats-3iy8u3_P.js";
-import { d as isQuerySpec, f as specTables, n as checkParams, o as isReadSet, r as containsPlaceholder, t as bindParams, u as createSpecs } from "./read-set-DhX2d04c.js";
+import { a as postgrestExecutor, n as StatsRecorder, r as recordStats } from "./stats-C5W-rBfR.js";
+import { d as isQuerySpec, f as specTables, n as checkParams, o as isReadSet, r as containsPlaceholder, t as bindParams, u as createSpecs } from "./read-set-4lI3W_gZ.js";
 import { t as validate } from "./standard-FUi3Z3-7.js";
 //#region src/core/batch.ts
 /**
@@ -91,26 +92,6 @@ function memoryCache() {
 	};
 }
 //#endregion
-//#region src/core/logger.ts
-const log = (method) => (message, fields) => {
-	if (fields === void 0) console[method](`better-supabase: ${message}`);
-	else console[method](`better-supabase: ${message}`, fields);
-};
-/** The default: `console`, with a `better-supabase:` prefix. */
-const consoleLogger = {
-	debug: log("debug"),
-	info: log("info"),
-	warn: log("warn"),
-	error: log("error")
-};
-const noop = () => {};
-const silentLogger = {
-	debug: noop,
-	info: noop,
-	warn: noop,
-	error: noop
-};
-//#endregion
 //#region src/core/events.ts
 /**
 * Observers only: a handler that throws is reported to the logger and never
@@ -208,7 +189,7 @@ function optionsOf(args) {
 	return options;
 }
 function signalOf(args) {
-	const signal = args?.signal;
+	const signal = args?.["signal"];
 	return signal instanceof AbortSignal ? signal : void 0;
 }
 function mutationKind(op) {
@@ -315,21 +296,21 @@ var OperationRunner = class {
 /** Creates the runtime repository object for one table. */
 function createRepository(runner, table) {
 	const { builder } = runner.runtime;
-	const selection = (args) => builder.selection(table, args?.select, args?.include);
+	const selection = (args) => builder.selection(table, args?.["select"], args?.["include"]);
 	const selectOp = (args, patch = {}) => ({
 		kind: "select",
 		table,
 		selection: selection(args),
-		where: builder.where(table, args?.where),
-		orderBy: builder.orderBy(table, args?.orderBy),
-		limit: typeof args?.limit === "number" ? args.limit : void 0,
-		offset: typeof args?.offset === "number" ? args.offset : void 0,
+		where: builder.where(table, args?.["where"]),
+		orderBy: builder.orderBy(table, args?.["orderBy"]),
+		limit: typeof args?.["limit"] === "number" ? args["limit"] : void 0,
+		offset: typeof args?.["offset"] === "number" ? args["offset"] : void 0,
 		count: void 0,
 		head: false,
 		single: void 0,
 		...patch
 	});
-	const returning = (args) => args?.returning === false ? void 0 : selection(args);
+	const returning = (args) => args?.["returning"] === false ? void 0 : selection(args);
 	const run = (op, args) => runner.run(op, optionsOf(args), signalOf(args));
 	const notFound = () => runner.fail(table, dbError("not_found", `No ${table.key} row matched`));
 	const base = {
@@ -358,7 +339,7 @@ function createRepository(runner, table) {
 		findUnique(args) {
 			return AsyncResult.from(async () => {
 				const op = selectOp(args, {
-					where: builder.uniqueKey(table, args.where),
+					where: builder.uniqueKey(table, args["where"]),
 					limit: 1
 				});
 				const result = await run(op, args);
@@ -379,8 +360,8 @@ function createRepository(runner, table) {
 		},
 		count(args) {
 			return AsyncResult.from(async () => {
-				const mode = args?.mode;
-				const op = selectOp({ where: args?.where }, {
+				const mode = args?.["mode"];
+				const op = selectOp({ where: args?.["where"] }, {
 					selection: {
 						columns: [],
 						includes: []
@@ -395,28 +376,28 @@ function createRepository(runner, table) {
 		aggregate(args) {
 			return AsyncResult.from(async () => {
 				const aggregation = builder.aggregation(table, args);
-				const orderBy = builder.orderBy(table, args.orderBy);
+				const orderBy = builder.orderBy(table, args["orderBy"]);
 				const grouped = new Set(aggregation.columns.map((c) => c.column));
 				const loose = orderBy.find((term) => !grouped.has(term.column));
 				if (loose) return runner.fail(table, dbError("invalid_request", `aggregate on "${table.key}" can only sort by groupBy columns, not "${loose.column}"`));
 				const op = selectOp({
-					where: args.where,
-					limit: args.limit,
-					offset: args.offset
+					where: args["where"],
+					limit: args["limit"],
+					offset: args["offset"]
 				}, {
 					selection: aggregation,
 					orderBy
 				});
 				const result = await run(op, args);
 				if (!result.ok) return result;
-				if (args.groupBy !== void 0) return ok(result.data.rows);
+				if (args["groupBy"] !== void 0) return ok(result.data.rows);
 				return ok(result.data.rows[0] ?? decodeRows(aggregation, [{}])[0] ?? {});
 			});
 		},
 		exists(args) {
 			return AsyncResult.from(async () => {
 				const columns = table.primaryKey.slice(0, 1).map((alias) => builder.selectColumn(table, alias));
-				const op = selectOp({ where: args?.where }, {
+				const op = selectOp({ where: args?.["where"] }, {
 					selection: {
 						columns,
 						includes: []
@@ -435,21 +416,21 @@ function createRepository(runner, table) {
 				const op = insertOp([data], args, void 0);
 				const result = await run(op, args);
 				if (!result.ok) return result;
-				return ok(args?.returning === false ? null : result.data.rows[0] ?? null);
+				return ok(args?.["returning"] === false ? null : result.data.rows[0] ?? null);
 			});
 		},
 		createMany(rows, args) {
 			return AsyncResult.from(async () => {
-				if (rows.length === 0) return ok(args?.returning === false ? { count: 0 } : []);
+				if (rows.length === 0) return ok(args?.["returning"] === false ? { count: 0 } : []);
 				const result = await run(insertOp(rows, args, void 0), args);
 				if (!result.ok) return result;
-				return ok(args?.returning === false ? { count: result.data.count ?? rows.length } : result.data.rows);
+				return ok(args?.["returning"] === false ? { count: result.data.count ?? rows.length } : result.data.rows);
 			});
 		},
 		update(id, patch, args) {
 			return AsyncResult.from(async () => {
 				const key = builder.primaryKey(table, id);
-				const expect = args?.expect ? builder.where(table, args.expect) : void 0;
+				const expect = args?.["expect"] ? builder.where(table, args["expect"]) : void 0;
 				const op = {
 					kind: "update",
 					table,
@@ -481,8 +462,8 @@ function createRepository(runner, table) {
 				const op = {
 					kind: "update",
 					table,
-					set: builder.row(table, args.data, "update"),
-					where: builder.where(table, args.where),
+					set: builder.row(table, args["data"], "update"),
+					where: builder.where(table, args["where"]),
 					returning: void 0
 				};
 				const result = await run(op, args);
@@ -491,19 +472,19 @@ function createRepository(runner, table) {
 		},
 		upsert(data, args) {
 			return AsyncResult.from(async () => {
-				const op = insertOp([data], args, conflictColumns(args?.onConflict));
+				const op = insertOp([data], args, conflictColumns(args?.["onConflict"]));
 				const result = await run(op, args);
 				if (!result.ok) return result;
-				return ok(args?.returning === false ? null : result.data.rows[0] ?? null);
+				return ok(args?.["returning"] === false ? null : result.data.rows[0] ?? null);
 			});
 		},
 		upsertMany(rows, args) {
 			return AsyncResult.from(async () => {
-				if (rows.length === 0) return ok(args?.returning === false ? { count: 0 } : []);
-				const op = insertOp(rows, args, conflictColumns(args?.onConflict));
+				if (rows.length === 0) return ok(args?.["returning"] === false ? { count: 0 } : []);
+				const op = insertOp(rows, args, conflictColumns(args?.["onConflict"]));
 				const result = await run(op, args);
 				if (!result.ok) return result;
-				return ok(args?.returning === false ? { count: result.data.count ?? rows.length } : result.data.rows);
+				return ok(args?.["returning"] === false ? { count: result.data.count ?? rows.length } : result.data.rows);
 			});
 		},
 		delete(id, args) {
@@ -521,7 +502,7 @@ function createRepository(runner, table) {
 		},
 		deleteMany(args) {
 			return AsyncResult.from(async () => {
-				const where = builder.where(table, args.where);
+				const where = builder.where(table, args["where"]);
 				if (!where) return runner.fail(table, dbError("invalid_request", "deleteMany needs a non-empty \"where\""));
 				const result = await run({
 					kind: "delete",
@@ -541,7 +522,7 @@ function createRepository(runner, table) {
 			returning: returning(args),
 			onConflict: conflict ? {
 				columns: conflict,
-				action: args?.ignoreDuplicates === true ? "ignore" : "update"
+				action: args?.["ignoreDuplicates"] === true ? "ignore" : "update"
 			} : void 0,
 			defaultToNull: false
 		};
@@ -557,11 +538,11 @@ function createRepository(runner, table) {
 		return invalidRequest(`Invalid onConflict on "${table.key}"`, table.key);
 	}
 	async function offsetPage(args) {
-		const size = Number(args.size);
+		const size = Number(args["size"]);
 		if (!Number.isInteger(size) || size < 1) return runner.fail(table, dbError("invalid_request", "\"size\" must be a positive integer"));
-		const number = args.page === void 0 ? 1 : Number(args.page);
+		const number = args["page"] === void 0 ? 1 : Number(args["page"]);
 		if (!Number.isInteger(number) || number < 1) return runner.fail(table, dbError("invalid_request", "\"page\" must be a positive integer"));
-		const count = args.count;
+		const count = args["count"];
 		const op = selectOp(args, {
 			limit: size + 1,
 			offset: (number - 1) * size,
@@ -583,19 +564,19 @@ function createRepository(runner, table) {
 		});
 	}
 	async function cursorPage(args) {
-		const size = Number(args.size);
+		const size = Number(args["size"]);
 		if (!Number.isInteger(size) || size < 1) return runner.fail(table, dbError("invalid_request", "\"size\" must be a positive integer"));
-		const orderBy = withTieBreaker(builder.orderBy(table, args.orderBy));
+		const orderBy = withTieBreaker(builder.orderBy(table, args["orderBy"]));
 		const { selection: withSort, added } = ensureColumns(selection(args), orderBy);
 		let after;
-		if (typeof args.after === "string") {
-			const values = decodeCursor(args.after);
+		if (typeof args["after"] === "string") {
+			const values = decodeCursor(args["after"]);
 			if (!values || values.length !== orderBy.length) return runner.fail(table, dbError("invalid_request", "Invalid cursor"));
 			after = keysetCondition(orderBy, values);
 		}
 		const op = selectOp(args, {
 			selection: withSort,
-			where: and(builder.where(table, args.where), after),
+			where: and(builder.where(table, args["where"]), after),
 			orderBy,
 			limit: size + 1,
 			offset: void 0
@@ -707,6 +688,10 @@ var BetterSupabase = class BetterSupabase {
 	get claimsSchema() {
 		return this.options.claims;
 	}
+	/** The schema set by `userMetadata()`; its output types `session.profile`. */
+	get userMetadataSchema() {
+		return this.options.userMetadata;
+	}
 	/**
 	* Returns a new instance whose servers validate verified JWT claims (custom
 	* access token hook output) with `schema`, and whose sessions are typed by it.
@@ -723,6 +708,24 @@ var BetterSupabase = class BetterSupabase {
 		}, this.events);
 	}
 	/**
+	* Returns a new instance whose sessions parse `user_metadata` with
+	* `schema` into a typed `session.profile`. Users can change their metadata
+	* with `auth.updateUser()`, so a failure only leaves `profile` undefined
+	* (with one warning), and no authorization code reads it. It is for
+	* display only: roles, memberships, the tenant and entitlements come from
+	* the verified claims, never from `profile`.
+	*
+	* ```ts
+	* const sb = defineSupabase(schema).userMetadata(z.object({ display_name: z.string() }));
+	* ```
+	*/
+	userMetadata(schema) {
+		return new BetterSupabase(this.schema, this.plugins, {
+			...this.options,
+			userMetadata: schema
+		}, this.events);
+	}
+	/**
 	* Returns a new instance whose `.orThrow()` throws `mapper(error)` instead
 	* of a `DbException`, and whose results `toBetterResult` maps the same way.
 	* Results themselves keep their `DbError`.
@@ -1011,7 +1014,7 @@ var BetterSupabase = class BetterSupabase {
 				repository[name] = method;
 			}
 		}
-		repository.extend = (build) => ({
+		repository["extend"] = (build) => ({
 			...repository,
 			...build(repository)
 		});
@@ -1065,4 +1068,4 @@ function defineSupabase(schema, options) {
 	return new BetterSupabase(schema, [], options);
 }
 //#endregion
-export { EventHub as a, cacheTargetOf as c, rpcCacheTargets as d, encodeCursor as i, memoryCache as l, defineSupabase as n, consoleLogger as o, decodeCursor as r, silentLogger as s, BetterSupabase as t, rowKey as u };
+export { EventHub as a, rowKey as c, encodeCursor as i, rpcCacheTargets as l, defineSupabase as n, cacheTargetOf as o, decodeCursor as r, memoryCache as s, BetterSupabase as t };

package/dist/{define-CTfWw-SS.d.ts → define-e3zI4_4g.d.ts}

@@ -1,10 +1,10 @@
-import { A as TableMeta, C as Relations, D as Simplify, E as SchemaMeta, M as UniqueKeyName, N as UniqueWhere, P as Update, S as RelationShape, T as Schema, h as Insert, k as TableKey, n as AnyModels, t as AnyFunctions, w as Row, y as PrimaryKeyValue } from "./types-C2fslP1z.js";
-import { g as Operation, l as CountMode, r as Executor } from "./executor-Bazhgsgq.js";
+import { A as SchemaMeta, C as PrimaryKeyValue, D as Relations, E as RelationShape, I as UniqueKeyName, L as UniqueWhere, N as TableKey, O as Row, P as TableMeta, R as Update, _ as Insert, j as Simplify, k as Schema, n as AnyModels, t as AnyFunctions } from "./types-C83v5SQz.js";
+import { g as Operation, l as CountMode, r as Executor } from "./executor-CGdNQ27g.js";
 import { p as DbError, s as ThrowMapper, t as AsyncResult, v as ErrorMapper } from "./result-CTkCZ6JA.js";
-import { a as EventHub, f as Logger, i as EventHandler, o as EventName, s as MutationNotice, u as RpcNotice } from "./events-2OJsVG_d.js";
-import { a as ExtensionOf, g as WithExtension, h as RequestContext, n as AnyPlugin, r as ApplyExtension } from "./plugin-HvGqCurB.js";
+import { a as EventHub, f as Logger, i as EventHandler, o as EventName, s as MutationNotice, u as RpcNotice } from "./events-DOt3nSO-.js";
+import { a as ExtensionOf, g as WithExtension, h as RequestContext, n as AnyPlugin, r as ApplyExtension } from "./plugin-C4TR9J0Z.js";
 import { t as StandardSchemaV1 } from "./standard-CyhRzctb.js";
-import { i as PostgrestPlan } from "./postgrest-Dm-vhY6R.js";
+import { i as PostgrestPlan } from "./postgrest-cAEQ_IQN.js";
 //#region src/ir/args.d.ts
 interface BaseOps<V> {
   readonly eq?: V;
@@ -562,6 +562,8 @@ interface DefineSupabaseOptions {
   readonly throwAs?: ThrowMapper;
   /** Validates verified JWT claims on the server. Prefer `sb.claims()`, which also types them. */
   readonly claims?: StandardSchemaV1;
+  /** Parses `user_metadata` into `session.profile`. Prefer `sb.userMetadata()`, which also types it. */
+  readonly userMetadata?: StandardSchemaV1;
   /**
    * PostgREST's `db-max-rows`: the most rows one read returns. An unbounded
    * `findMany` that returns this many sets `truncated` on the `query` event
@@ -586,7 +588,7 @@ interface RpcDefinition {
  * The isomorphic definition of your data layer: schema plus plugins. Holds no
  * secrets and no connection; `connect()` binds it to a client per request.
  */
-declare class BetterSupabase<M extends AnyModels = AnyModels, D = unknown, F extends AnyFunctions = AnyFunctions, E = unknown, C = unknown> {
+declare class BetterSupabase<M extends AnyModels = AnyModels, D = unknown, F extends AnyFunctions = AnyFunctions, E = unknown, C = unknown, P = unknown> {
   #private;
   readonly schema: Schema<M, D, F>;
   readonly plugins: readonly AnyPlugin[];
@@ -596,6 +598,8 @@ declare class BetterSupabase<M extends AnyModels = AnyModels, D = unknown, F ext
   get meta(): SchemaMeta;
   /** The schema set by `claims()`; its output types `session.claims`. */
   get claimsSchema(): StandardSchemaV1<unknown, C> | undefined;
+  /** The schema set by `userMetadata()`; its output types `session.profile`. */
+  get userMetadataSchema(): StandardSchemaV1<unknown, P> | undefined;
   /**
    * Returns a new instance whose servers validate verified JWT claims (custom
    * access token hook output) with `schema`, and whose sessions are typed by it.
@@ -605,7 +609,20 @@ declare class BetterSupabase<M extends AnyModels = AnyModels, D = unknown, F ext
    * const sb = defineSupabase(schema).claims(z.object({ tenant_id: z.uuid() }));
    * ```
    */
-  claims<S extends StandardSchemaV1>(schema: S): BetterSupabase<M, D, F, E, StandardSchemaV1.InferOutput<S>>;
+  claims<S extends StandardSchemaV1>(schema: S): BetterSupabase<M, D, F, E, StandardSchemaV1.InferOutput<S>, P>;
+  /**
+   * Returns a new instance whose sessions parse `user_metadata` with
+   * `schema` into a typed `session.profile`. Users can change their metadata
+   * with `auth.updateUser()`, so a failure only leaves `profile` undefined
+   * (with one warning), and no authorization code reads it. It is for
+   * display only: roles, memberships, the tenant and entitlements come from
+   * the verified claims, never from `profile`.
+   *
+   * ```ts
+   * const sb = defineSupabase(schema).userMetadata(z.object({ display_name: z.string() }));
+   * ```
+   */
+  userMetadata<S extends StandardSchemaV1>(schema: S): BetterSupabase<M, D, F, E, C, StandardSchemaV1.InferOutput<S>>;
   /**
    * Returns a new instance whose `.orThrow()` throws `mapper(error)` instead
    * of a `DbException`, and whose results `toBetterResult` maps the same way.
@@ -615,7 +632,7 @@ declare class BetterSupabase<M extends AnyModels = AnyModels, D = unknown, F ext
    * const sb = defineSupabase(schema).mapError((error) => new AppError(error));
    * ```
    */
-  mapError(mapper: (error: DbError) => unknown): BetterSupabase<M, D, F, E, C>;
+  mapError(mapper: (error: DbError) => unknown): BetterSupabase<M, D, F, E, C, P>;
   /**
    * Builds serializable `QuerySpec`s with the same arguments and result types
    * as the repository: `sb.spec.customers.findMany({ select: ['id'] })`.
@@ -624,7 +641,7 @@ declare class BetterSupabase<M extends AnyModels = AnyModels, D = unknown, F ext
   /** App keys of every table a spec reads; mutations of any of them make it stale. */
   tablesOf(spec: QuerySpec): string[];
   /** Returns a new instance with the plugin appended. */
-  use<P extends AnyPlugin>(plugin: P): BetterSupabase<M, D, F, WithExtension<E, ExtensionOf<P>>, C>;
+  use<Q extends AnyPlugin>(plugin: Q): BetterSupabase<M, D, F, WithExtension<E, ExtensionOf<Q>>, C, P>;
   /**
    * Declares the tables an RPC writes, so cache adapters and live queries
    * invalidate them after it succeeds.
@@ -635,7 +652,7 @@ declare class BetterSupabase<M extends AnyModels = AnyModels, D = unknown, F ext
    */
   defineRpc(name: Extract<keyof F, string>, options: {
     readonly invalidates: readonly TableKey<M>[];
-  }): BetterSupabase<M, D, F, E, C>;
+  }): BetterSupabase<M, D, F, E, C, P>;
   /** Observes queries, mutations, errors, auth and refreshes. */
   on<K extends EventName>(name: K, handler: EventHandler<K>): () => void;
   /**

package/dist/edge/index.d.ts

@@ -1,7 +1,7 @@
-import { k as TableKey, n as AnyModels, t as AnyFunctions } from "../types-C2fslP1z.js";
-import { t as BetterSupabase } from "../define-CTfWw-SS.js";
-import { d as ServerContext, f as ServerOptions, l as BetterServer, n as GuardOptions } from "../respond-PoTpy5DT.js";
-import { i as ResourceRouteOptions } from "../resource-SkPTRJDD.js";
+import { N as TableKey, n as AnyModels, t as AnyFunctions } from "../types-C83v5SQz.js";
+import { t as BetterSupabase } from "../define-e3zI4_4g.js";
+import { d as ServerContext, f as ServerOptions, l as BetterServer, n as GuardOptions } from "../respond-Dne1ARSa.js";
+import { i as ResourceRouteOptions } from "../resource-CgZa3YG_.js";
 //#region src/edge/index.d.ts
 export interface CorsOptions {
   /** Allowed origins, or `*`. Defaults to `*`. */

package/dist/edge/index.js

@@ -1,7 +1,7 @@
 import { n as dbError } from "../errors-Bl3rkOzo.js";
-import { a as problemResponse } from "../problem-DPu6Fh-t.js";
-import { i as respond, n as guard, o as createServer, s as extendServer, t as defaultExpose } from "../respond-4-dhoV7x.js";
-import { t as defineResource } from "../resource-CYiu6Ygi.js";
+import { a as problemResponse } from "../problem-BTkTtRV9.js";
+import { i as respond, n as guard, o as createServer, s as extendServer, t as defaultExpose } from "../respond-DMcbQwfN.js";
+import { t as defineResource } from "../resource-BHEWmQJK.js";
 //#region src/edge/index.ts
 const SUPABASE_CORS_HEADERS = [
 	"authorization",

package/dist/entitlements-CTEBm7IB.js

@@ -0,0 +1,20 @@
+//#region src/auth/entitlements.ts
+/**
+* Whether the session's plan-features claim grants `key` in `tenantId`.
+* `claim` is `config.claims.features` (default `features`), the claim
+* `better_supabase.feature_claims()` fills. The claim is as fresh as the
+* token: enforce it in RLS with `better_supabase.has_entitlement()`, and
+* refresh the session after checkout.
+*/
+function hasEntitlement(session, tenantId, key, claim = "features") {
+	if (session.kind !== "user") return false;
+	const claims = session.claims;
+	if (!isRecord(claims)) return false;
+	const features = claims[claim];
+	if (!isRecord(features) || !Object.hasOwn(features, tenantId)) return false;
+	const keys = features[tenantId];
+	return Array.isArray(keys) && keys.includes(key);
+}
+const isRecord = (value) => typeof value === "object" && value !== null;
+//#endregion
+export { hasEntitlement as t };

package/dist/entitlements-Dng-ctuT.d.ts

@@ -0,0 +1,42 @@
+import { t as AuthSession } from "./view-D1s0wa0T.js";
+//#region src/auth/entitlements.d.ts
+/**
+ * One entry of the `memberships` claim, in PermDock's shape. PermDock strips
+ * `null`s, so optional fields are absent rather than `null`.
+ */
+interface MembershipClaim {
+  /** The scope the membership is in, e.g. `tenant` or `organization`. */
+  readonly scope: string;
+  readonly id: string;
+  /** Parent scopes, e.g. `{ organization: '...' }` for a project membership. */
+  readonly within?: Readonly<Record<string, string>>;
+  readonly roles: readonly string[];
+  readonly via?: string;
+  /** Unix seconds. */
+  readonly expiresAt?: number;
+  readonly grantedBy?: string;
+  readonly reason?: string;
+  readonly member?: {
+    readonly group: string;
+  };
+  readonly managedBy?: "idp";
+  /** Seats, not plan features: those are in the `features` claim. */
+  readonly entitlements?: readonly string[];
+}
+/**
+ * Entitlement keys of the `features` claim: the literal union when
+ * `sb.claims(schema)` declares one (`z.enum([...])`), otherwise `string`.
+ */
+type EntitlementKey<C> = C extends {
+  readonly features?: infer F;
+} ? NonNullable<F> extends Readonly<Record<string, readonly (infer K)[]>> ? K extends string ? K : string : string : string;
+/**
+ * Whether the session's plan-features claim grants `key` in `tenantId`.
+ * `claim` is `config.claims.features` (default `features`), the claim
+ * `better_supabase.feature_claims()` fills. The claim is as fresh as the
+ * token: enforce it in RLS with `better_supabase.has_entitlement()`, and
+ * refresh the session after checkout.
+ */
+declare function hasEntitlement<C>(session: AuthSession<C>, tenantId: string, key: EntitlementKey<C>, claim?: string): boolean;
+//#endregion
+export { MembershipClaim as n, hasEntitlement as r, EntitlementKey as t };

package/dist/events/index.d.ts

@@ -1,2 +1,2 @@
-import { a as HttpMode, c as RowEventData, d as httpSink, f as isCloudEvent, i as ForwardOptions, l as forwardMutations, m as toHttp, n as CloudEventOptions, o as HttpSinkOptions, p as toCloudEvents, r as EventSink, s as ROW_EVENT_TYPES, t as CloudEvent, u as fromHttp } from "../index-DQVvHzjW.js";
+import { a as HttpMode, c as RowEventData, d as httpSink, f as isCloudEvent, i as ForwardOptions, l as forwardMutations, m as toHttp, n as CloudEventOptions, o as HttpSinkOptions, p as toCloudEvents, r as EventSink, s as ROW_EVENT_TYPES, t as CloudEvent, u as fromHttp } from "../index-Ciu5Xlml.js";
 export { CloudEvent, CloudEventOptions, EventSink, ForwardOptions, HttpMode, HttpSinkOptions, ROW_EVENT_TYPES, RowEventData, forwardMutations, fromHttp, httpSink, isCloudEvent, toCloudEvents, toHttp };

package/dist/{events-2OJsVG_d.d.ts → events-DOt3nSO-.d.ts}

@@ -1,6 +1,6 @@
-import { g as Operation } from "./executor-Bazhgsgq.js";
+import { g as Operation } from "./executor-CGdNQ27g.js";
 import { p as DbError } from "./result-CTkCZ6JA.js";
-import { h as RequestContext, l as MutationKind } from "./plugin-HvGqCurB.js";
+import { h as RequestContext, l as MutationKind } from "./plugin-C4TR9J0Z.js";
 //#region src/core/logger.d.ts
 type LogFields = Readonly<Record<string, unknown>>;
 /**

package/dist/{executor-Bje4suQF.d.ts → executor-BYXQ9AGn.d.ts}

@@ -1,4 +1,4 @@
-import { r as Executor } from "./executor-Bazhgsgq.js";
+import { r as Executor } from "./executor-CGdNQ27g.js";
 import { y as RawDbError } from "./result-CTkCZ6JA.js";
 //#region src/postgres/executor.d.ts
 /**

package/dist/{executor-Bazhgsgq.d.ts → executor-CGdNQ27g.d.ts}

@@ -1,4 +1,4 @@
-import { A as TableMeta, o as Codec, x as RelationMeta } from "./types-C2fslP1z.js";
+import { P as TableMeta, T as RelationMeta, c as Codec } from "./types-C83v5SQz.js";
 import { o as Result, v as ErrorMapper } from "./result-CTkCZ6JA.js";
 //#region src/ir/types.d.ts
 /**

package/dist/{executor-Ceq60hPM.js → executor-DeppvirK.js}

@@ -1,6 +1,6 @@
 import { c as mapDbError, n as dbError } from "./errors-Bl3rkOzo.js";
 import { i as ok, n as err, o as toDbError } from "./result-DWXatkd6.js";
-import { t as compileSql } from "./sql-M8l3fnS0.js";
+import { t as compileSql } from "./sql-DTjA1LPj.js";
 //#region src/postgres/executor.ts
 function isPgError(value) {
 	return typeof value === "object" && value !== null && typeof value.code === "string";

package/dist/guards-BnzDvFrz.js

@@ -0,0 +1,10 @@
+//#region src/core/guards.ts
+/**
+* `Array.isArray` narrows `unknown` and readonly arrays to `any[]`; this keeps
+* the element type (or `unknown`).
+*/
+function isList(value) {
+	return Array.isArray(value);
+}
+//#endregion
+export { isList as t };