better-supabase 0.1.0 → 0.2.0

package/dist/hono/index.d.ts

@@ -1,8 +1,8 @@
-import { k as TableKey, n as AnyModels, t as AnyFunctions } from "../types-C2fslP1z.js";
-import { t as BetterSupabase } from "../define-CTfWw-SS.js";
-import { r as AuthState } from "../resolve-DW8h9NPm.js";
-import { d as ServerContext, f as ServerOptions, l as BetterServer, n as GuardOptions } from "../respond-PoTpy5DT.js";
-import { i as ResourceRouteOptions } from "../resource-SkPTRJDD.js";
+import { N as TableKey, n as AnyModels, t as AnyFunctions } from "../types-C83v5SQz.js";
+import { t as BetterSupabase } from "../define-e3zI4_4g.js";
+import { r as AuthState } from "../resolve-CjHILk2w.js";
+import { d as ServerContext, f as ServerOptions, l as BetterServer, n as GuardOptions } from "../respond-Dne1ARSa.js";
+import { i as ResourceRouteOptions } from "../resource-CgZa3YG_.js";
 import { Context, ErrorHandler, Hono, MiddlewareHandler } from "hono";
 //#region src/hono/index.d.ts
 /** Hono `Env` with the request's better-supabase context in `c.var`. */

package/dist/hono/index.js

@@ -1,7 +1,7 @@
 import { n as dbError, r as dbErrorOf } from "../errors-Bl3rkOzo.js";
-import { a as problemResponse } from "../problem-DPu6Fh-t.js";
-import { i as respond, n as guard, o as createServer, s as extendServer, t as defaultExpose } from "../respond-4-dhoV7x.js";
-import { t as defineResource } from "../resource-CYiu6Ygi.js";
+import { a as problemResponse } from "../problem-BTkTtRV9.js";
+import { i as respond, n as guard, o as createServer, s as extendServer, t as defaultExpose } from "../respond-DMcbQwfN.js";
+import { t as defineResource } from "../resource-BHEWmQJK.js";
 import { Hono } from "hono";
 //#region src/hono/index.ts
 function contextOf(c) {

package/dist/{index-JXHBuS53.d.ts → index-Bw1bwtC0.d.ts}

@@ -1,7 +1,7 @@
-import { k as TableKey, n as AnyModels, t as AnyFunctions, w as Row } from "./types-C2fslP1z.js";
-import { l as CountMode } from "./executor-Bazhgsgq.js";
+import { N as TableKey, O as Row, n as AnyModels, t as AnyFunctions } from "./types-C83v5SQz.js";
+import { l as CountMode } from "./executor-CGdNQ27g.js";
 import { b as ValidationIssue, t as AsyncResult } from "./result-CTkCZ6JA.js";
-import { C as FindExt, Ct as WhereInput, O as RepositoryOf, T as OffsetPageArgs, dt as IncludeArg, gt as OrderByArg, t as BetterSupabase, vt as Payload, w as OffsetPage, xt as SelectArg } from "./define-CTfWw-SS.js";
+import { C as FindExt, Ct as WhereInput, O as RepositoryOf, T as OffsetPageArgs, dt as IncludeArg, gt as OrderByArg, t as BetterSupabase, vt as Payload, w as OffsetPage, xt as SelectArg } from "./define-e3zI4_4g.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/list/index.d.ts
 /** Facet value meaning "not set": filters with `is null`. */

package/dist/{index-Hf8PP9sP.d.ts → index-CBDufH1M.d.ts}

@@ -1,11 +1,11 @@
 import { p as DbError } from "./result-CTkCZ6JA.js";
-import { Z as QuerySpec } from "./define-CTfWw-SS.js";
-import { i as BrowserAuth, t as AuthSnapshot } from "./index-Sw43J8HG.js";
+import { Z as QuerySpec } from "./define-e3zI4_4g.js";
+import { i as BrowserAuth, t as AuthSnapshot } from "./index-D4v7sncu.js";
 import { n as TemplateValues } from "./template-mbvlysOo.js";
-import { t as AuthSession } from "./view-B0ltUmTi.js";
-import { a as LiveSource, g as Topic, h as SubscriptionStatus, p as SubscribeOptions, r as LiveCountSeed, u as EventSchemas, v as TopicHandlers, y as TopicMessage } from "./live-6b9i72Ux.js";
-import "./entitlements-BBg61DQZ.js";
-import "./session-C3osL21k.js";
+import { t as AuthSession } from "./view-D1s0wa0T.js";
+import { a as LiveSource, g as Topic, h as SubscriptionStatus, p as SubscribeOptions, r as LiveCountSeed, u as EventSchemas, v as TopicHandlers, y as TopicMessage } from "./live-DJyZMD6w.js";
+import "./entitlements-Dng-ctuT.js";
+import "./session-C3LxnQ0e.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { ReactNode } from "react";
 import { StandardSchemaV1 } from "@standard-schema/spec";
@@ -37,13 +37,17 @@ interface BetterHooks<B extends BrowserLike> {
   readonly useQueries: () => B["queries"];
   readonly useSupabase: () => SupabaseClient;
   readonly useAuth: () => AuthSnapshot;
-  /** `useSession()` with the claims typed by the browser's `sb.claims(schema)`. */
-  readonly useSession: () => AuthSession<ClaimsOf<B>>;
+  /** `useSession()` typed by the browser's `sb.claims(schema)` and `sb.userMetadata(schema)`. */
+  readonly useSession: () => AuthSession<ClaimsOf<B>, ProfileOf<B>>;
 }
 /** The claims type of a browser's `sb.claims(schema)`, `unknown` without one. */
 type ClaimsOf<B extends BrowserLike> = B["sb"] extends {
   readonly claimsSchema: StandardSchemaV1<unknown, infer C> | undefined;
 } ? C : unknown;
+/** The profile type of a browser's `sb.userMetadata(schema)`, `unknown` without one. */
+type ProfileOf<B extends BrowserLike> = B["sb"] extends {
+  readonly userMetadataSchema: StandardSchemaV1<unknown, infer P> | undefined;
+} ? P : unknown;
 /**
  * Hooks typed for your schema.
  *
@@ -71,8 +75,8 @@ interface BroadcastOptions extends Omit<SubscribeOptions, "onStatus"> {
 declare function useBroadcast<P extends string, E extends EventSchemas>(topic: Topic<P, E>, values: TemplateValues<P> | null | undefined, handlers?: TopicHandlers<E>, options?: BroadcastOptions): SubscriptionStatus;
 interface LiveQueryHookOptions {
   /**
-   * Tenant for tenant-scoped tables. Defaults to the `org_id` claim
-   * (top-level or in `app_metadata`).
+   * Tenant for tenant-scoped tables. Defaults to the `config.claims.tenant`
+   * claim (`tenant_id`, top-level or in `app_metadata`).
    */
   readonly tenant?: string;
   /** Defaults to 100 ms. */
@@ -113,4 +117,4 @@ interface LiveCount {
  */
 declare function useLiveCount(source: QuerySpec<string, "count", number> | LiveCountSeed | null | undefined, options?: LiveCountHookOptions): LiveCount;
 //#endregion
-export { BrowserLike as a, LiveCountHookOptions as c, useAuth as d, useBroadcast as f, useSupabase as h, BroadcastOptions as i, LiveQueryHookOptions as l, useLiveQuery as m, BetterSupabaseProvider as n, ClaimsOf as o, useLiveCount as p, BetterSupabaseProviderProps as r, LiveCount as s, BetterHooks as t, createHooks as u };
+export { BrowserLike as a, LiveCountHookOptions as c, createHooks as d, useAuth as f, useSupabase as g, useLiveQuery as h, BroadcastOptions as i, LiveQueryHookOptions as l, useLiveCount as m, BetterSupabaseProvider as n, ClaimsOf as o, useBroadcast as p, BetterSupabaseProviderProps as r, LiveCount as s, BetterHooks as t, ProfileOf as u };

package/dist/{index-cEeweTeM.d.ts → index-CG69s15v.d.ts}

@@ -1,6 +1,6 @@
-import { m as StoredSession } from "./resolve-DW8h9NPm.js";
-import "./view-B0ltUmTi.js";
-import "./entitlements-BBg61DQZ.js";
+import { m as StoredSession } from "./resolve-CjHILk2w.js";
+import "./view-D1s0wa0T.js";
+import "./entitlements-Dng-ctuT.js";
 //#region src/auth/refresh.d.ts
 interface RefreshOptions {
   readonly url: string;

package/dist/{index-DQVvHzjW.d.ts → index-Ciu5Xlml.d.ts}

@@ -1,6 +1,6 @@
-import { E as SchemaMeta } from "./types-C2fslP1z.js";
-import { a as EventHub, s as MutationNotice } from "./events-2OJsVG_d.js";
-import { l as MutationKind } from "./plugin-HvGqCurB.js";
+import { A as SchemaMeta } from "./types-C83v5SQz.js";
+import { a as EventHub, s as MutationNotice } from "./events-DOt3nSO-.js";
+import { l as MutationKind } from "./plugin-C4TR9J0Z.js";
 //#region src/events/index.d.ts
 /** A CloudEvents 1.0 event. Extension attributes are lowercase alphanumerics. */
 interface CloudEvent<T = unknown> {

package/dist/{index-Sw43J8HG.d.ts → index-D4v7sncu.d.ts}

@@ -1,7 +1,7 @@
-import { n as AnyModels, t as AnyFunctions } from "./types-C2fslP1z.js";
-import { t as BetterSupabase, y as Db } from "./define-CTfWw-SS.js";
+import { n as AnyModels, t as AnyFunctions } from "./types-C83v5SQz.js";
+import { t as BetterSupabase, y as Db } from "./define-e3zI4_4g.js";
 import { c as PublicEnv } from "./index-Dy6kuF0P.js";
-import { i as Queries } from "./index-Dup-nSe9.js";
+import { i as Queries } from "./index-K-3WM2Hp.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 //#region src/client/index.d.ts
 interface BrowserOptions {
@@ -39,9 +39,9 @@ interface BrowserAuth {
   /** `useSyncExternalStore`-compatible. */
   readonly subscribe: (listener: () => void) => () => void;
 }
-interface BetterBrowser<M extends AnyModels, F extends AnyFunctions, E, C = unknown> {
+interface BetterBrowser<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> {
   /** The definition the browser was created from (schema metadata, specs, live queries). */
-  readonly sb: BetterSupabase<M, unknown, F, E, C>;
+  readonly sb: BetterSupabase<M, unknown, F, E, C, P>;
   readonly supabase: SupabaseClient;
   /** Repositories with the current session's actor and claims. */
   readonly db: Db<M, F, E, SupabaseClient>;
@@ -57,6 +57,6 @@ interface BetterBrowser<M extends AnyModels, F extends AnyFunctions, E, C = unkn
  * export const browser = createBrowser(sb, { env: { url, publishableKey } });
  * ```
  */
-declare function createBrowser<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown>(sb: BetterSupabase<M, D, F, E, C>, options?: BrowserOptions): BetterBrowser<M, F, E, C>;
+declare function createBrowser<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown>(sb: BetterSupabase<M, D, F, E, C, P>, options?: BrowserOptions): BetterBrowser<M, F, E, C, P>;
 //#endregion
 export { BrowserOptions as a, BrowserAuth as i, AuthUser as n, createBrowser as o, BetterBrowser as r, AuthSnapshot as t };

package/dist/{index-BD6wKthp.d.ts → index-DOsjFvMf.d.ts}

@@ -1,4 +1,4 @@
-import { E as SchemaMeta, i as Casing } from "./types-C2fslP1z.js";
+import { A as SchemaMeta, a as Casing, b as PermdockBucketPolicy, i as BucketPolicyName } from "./types-C83v5SQz.js";
 import { GeneratorMetadata, Queryable } from "@supabase/postgrest-typegen";
 //#region src/cli/introspect/types.d.ts
 /**
@@ -57,6 +57,8 @@ interface ExtrasHookFunction extends ExtrasFunction {
   readonly publicExecute: boolean;
   /** Of the same roles, those with `usage` on its schema. */
   readonly schemaUsage: readonly string[];
+  /** The function body (`pg_proc.prosrc`). Absent in snapshots that predate it. */
+  readonly source?: string;
 }
 /** A function as doctor needs it for RLS checks, in any schema. */
 interface ExtrasFunction {
@@ -337,8 +339,18 @@ interface SoftDeleteConfig {
 }
 interface TenantConfig {
   readonly column?: string;
-  /** JWT claim holding the tenant id. */
-  readonly claim?: string;
+}
+/**
+ * Claim names shared by the SQL kit, codegen and the runtime defaults. They
+ * follow PermDock's claim contract.
+ */
+interface ClaimsConfig {
+  /** Top-level claim holding the active tenant id. Defaults to `tenant_id`. */
+  readonly tenant?: string;
+  /** `scope` of the tenant entries `membership_claims()` writes. Defaults to `tenant`. */
+  readonly scope?: string;
+  /** Claim holding plan features per tenant (`{ [tenantId]: string[] }`). Defaults to `features`. */
+  readonly features?: string;
 }
 interface ActorConfig {
   readonly createdBy?: string;
@@ -355,8 +367,8 @@ interface BucketConfig {
   readonly public?: boolean;
   /** Path template with `{placeholders}`, e.g. `{orgId}/{customerId}/logo.webp`. */
   readonly path: string;
-  /** Generated storage policy. */
-  readonly policy?: "tenant" | "owner" | "public" | "none";
+  /** Generated storage policy, or a PermDock policy (`{ permdock, scope }`). */
+  readonly policy?: BucketPolicyName | PermdockBucketPolicy;
   readonly fileSizeLimit?: string;
   readonly allowedMimeTypes?: readonly string[];
 }
@@ -397,6 +409,13 @@ interface DoctorConfig {
    * asks for an inlinable `language sql stable` function. Defaults to 5.
    */
   readonly policyHelperLimit?: number;
+  /**
+   * The BS405 limit in bytes. With a `permdock.config.ts` it is PermDock's
+   * budget for `memberships` plus `attrs` (default 1024, matching
+   * `supabase.hook.budget`) and the whole token keeps 2048. Without one it
+   * limits the whole token's claims (default 2048).
+   */
+  readonly claimsLimit?: number;
 }
 /**
  * Runtime types for columns whose JSON form loses information. Defaults
@@ -530,6 +549,7 @@ interface BetterSupabaseConfig {
   readonly generators?: readonly Generator[];
   /** Enables plugin flags in the generated metadata. */
   readonly plugins?: PluginFlagsConfig;
+  readonly claims?: ClaimsConfig;
   readonly buckets?: Readonly<Record<string, BucketConfig>>;
   /** Realtime topic templates: `{ notifications: 'org:{orgId}:notifications' }`. */
   readonly topics?: Readonly<Record<string, string>>;
@@ -570,6 +590,7 @@ interface ResolvedConfig {
     readonly tenant: Required<TenantConfig> | undefined;
     readonly actor: Required<ActorConfig> | undefined;
   };
+  readonly claims: Required<ClaimsConfig>;
   readonly buckets: Readonly<Record<string, BucketConfig>>;
   readonly entitlements: {
     readonly table: string;
@@ -586,7 +607,7 @@ interface ResolvedConfig {
   readonly sql: Required<SqlConfig>;
   readonly seed: Required<SeedConfig>;
   readonly openapi: Required<OpenApiConfig>;
-  readonly doctor: Required<DoctorConfig>;
+  readonly doctor: Required<Omit<DoctorConfig, "claimsLimit">> & Pick<DoctorConfig, "claimsLimit">;
 }
 declare const CONFIG_SCHEMA_URL = "https://unpkg.com/better-supabase/schemas/config-v1.json";
 /** Identity helper that types `better-supabase.config.ts`. */
@@ -594,4 +615,4 @@ declare function defineConfig(config: BetterSupabaseConfig): BetterSupabaseConfi
 /** Applies defaults. Paths stay relative to `root`. */
 declare function resolveConfig(config: BetterSupabaseConfig, root: string): ResolvedConfig;
 //#endregion
-export { ExtrasHook as $, resolveConfig as A, CatalogCheck as B, SqlConfig as C, VectorDistance as D, TimestampsConfig as E, valibot as F, CatalogFunctionArg as G, CatalogEnum as H, JsonSchemaGeneratorOptions as I, CatalogPolicy as J, CatalogGrant as K, buildJsonSchema as L, ZodGeneratorOptions as M, zod as N, VectorSearchConfig as O, ValibotGeneratorOptions as P, ExtrasFunction as Q, jsonSchema as R, SourceConfig as S, TenantConfig as T, CatalogForeignKey as U, CatalogColumn as V, CatalogFunction as W, CatalogTrigger as X, CatalogTable as Y, CatalogUnique as Z, RealtimeConfig as _, CodecsConfig as a, SnapshotExtras as at, SeedConfig as b, ExposeConfig as c, GeneratorInput as d, ExtrasHookFunction as et, JsonSchemaSource as f, Privilege as g, PluginFlagsConfig as h, CONFIG_SCHEMA_URL as i, SnapshotBucket as it, resolveJsonSchema as j, defineConfig as k, GeneratedFile as l, OpenApiConfig as m, BetterSupabaseConfig as n, ForeignKeyAction as nt, DoctorConfig as o, GeneratorMetadata as ot, JsonTypeConfig as p, CatalogIndex as q, BucketConfig as r, Snapshot as rt, EntitlementsConfig as s, Queryable as st, ActorConfig as t, ExtrasTable as tt, Generator as u, ResolvedConfig as v, TableConfig as w, SoftDeleteConfig as x, ResolvedExpose as y, Catalog as z };
+export { ExtrasFunction as $, defineConfig as A, Catalog as B, SourceConfig as C, TimestampsConfig as D, TenantConfig as E, ValibotGeneratorOptions as F, CatalogFunction as G, CatalogColumn as H, valibot as I, CatalogIndex as J, CatalogFunctionArg as K, JsonSchemaGeneratorOptions as L, resolveJsonSchema as M, ZodGeneratorOptions as N, VectorDistance as O, zod as P, CatalogUnique as Q, buildJsonSchema as R, SoftDeleteConfig as S, TableConfig as T, CatalogEnum as U, CatalogCheck as V, CatalogForeignKey as W, CatalogTable as X, CatalogPolicy as Y, CatalogTrigger as Z, Privilege as _, ClaimsConfig as a, SnapshotBucket as at, ResolvedExpose as b, EntitlementsConfig as c, Queryable as ct, Generator as d, ExtrasHook as et, GeneratorInput as f, PluginFlagsConfig as g, OpenApiConfig as h, CONFIG_SCHEMA_URL as i, Snapshot as it, resolveConfig as j, VectorSearchConfig as k, ExposeConfig as l, JsonTypeConfig as m, BetterSupabaseConfig as n, ExtrasTable as nt, CodecsConfig as o, SnapshotExtras as ot, JsonSchemaSource as p, CatalogGrant as q, BucketConfig as r, ForeignKeyAction as rt, DoctorConfig as s, GeneratorMetadata as st, ActorConfig as t, ExtrasHookFunction as tt, GeneratedFile as u, RealtimeConfig as v, SqlConfig as w, SeedConfig as x, ResolvedConfig as y, jsonSchema as z };

package/dist/{index-DRid0qIv.d.ts → index-DbxFr7XG.d.ts}

@@ -1,5 +1,5 @@
-import { E as SchemaMeta } from "./types-C2fslP1z.js";
-import { f as OpenApiParameter } from "./index-JXHBuS53.js";
+import { A as SchemaMeta } from "./types-C83v5SQz.js";
+import { f as OpenApiParameter } from "./index-Bw1bwtC0.js";
 //#region src/openapi/index.d.ts
 type Json = Record<string, unknown>;
 type ResourceOperation = "list" | "get" | "create" | "update" | "delete";

package/dist/{index-Nxo3TJcm.d.ts → index-DuP14VHo.d.ts}

@@ -1,9 +1,10 @@
+import { b as PermdockBucketPolicy, i as BucketPolicyName } from "./types-C83v5SQz.js";
 import { p as DbError, t as AsyncResult } from "./result-CTkCZ6JA.js";
 import { n as StoragePath, t as PathIn } from "./path-Cv__-OTj.js";
 import { n as TemplateValues, t as TemplateParams } from "./template-mbvlysOo.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 //#region src/storage/index.d.ts
-type BucketPolicy = "tenant" | "owner" | "public" | "none";
+type BucketPolicy = BucketPolicyName | PermdockBucketPolicy;
 interface BucketConfig<P extends string = string, Id extends string = string> {
   /** Bucket id, e.g. `customer-logos`. */
   readonly id: Id;
@@ -13,7 +14,14 @@ interface BucketConfig<P extends string = string, Id extends string = string> {
   /**
    * Generated `storage.objects` policies. `tenant` and `owner` match a path
    * segment against the JWT; `public` allows reads; `none` leaves access to
-   * the secret key. Defaults to `none`.
+   * the secret key; `{ permdock, scope }` calls PermDock's SQL helpers.
+   * Defaults to `none`.
+   *
+   * The helpers check role and scope only. Use `permdock` just for
+   * permissions whose grants have no row conditions beyond the scope: for a
+   * permission with row conditions (e.g. `ownerId = principal.id`) the bucket
+   * grants every object in the scope. Leave those to the policies
+   * `permdock rls generate` writes.
    */
   readonly policy?: BucketPolicy;
   /** `'5MiB'`, `'500KB'` or bytes. */
@@ -23,7 +31,7 @@ interface BucketConfig<P extends string = string, Id extends string = string> {
   readonly tenant?: {
     /** Placeholder holding the tenant id. Defaults to `orgId`. */
     readonly param?: string;
-    /** JWT claim paths, first match wins. Defaults to `org_id`, then `app_metadata.org_id`. */
+    /** JWT claim paths, first match wins. Defaults to `tenant_id`, then `app_metadata.tenant_id`. */
     readonly claim?: string | readonly string[];
     /** SQL expression for the tenant id, instead of `claim`. */
     readonly sql?: string;

package/dist/{index-Dup-nSe9.d.ts → index-K-3WM2Hp.d.ts}

@@ -1,6 +1,6 @@
-import { N as UniqueWhere, P as Update, h as Insert, k as TableKey, n as AnyModels, t as AnyFunctions, y as PrimaryKeyValue } from "./types-C2fslP1z.js";
+import { C as PrimaryKeyValue, L as UniqueWhere, N as TableKey, R as Update, _ as Insert, n as AnyModels, t as AnyFunctions } from "./types-C83v5SQz.js";
 import { _ as DbException } from "./result-CTkCZ6JA.js";
-import { C as FindExt, Ct as WhereInput, M as UpsertArgs, N as WriteArgs, S as DeleteExt, T as OffsetPageArgs, X as InferResult, Z as QuerySpec, _ as CursorPage, it as AggregateResult, j as UpdateArgs, k as Returned, l as CacheAdapter, lt as FindFirstArgs, rt as AggregateArgs, st as CountArgs, t as BetterSupabase, ut as FindManyArgs, v as CursorPageArgs, vt as Payload, w as OffsetPage, x as DeleteArgs, y as Db, yt as ReadArgs } from "./define-CTfWw-SS.js";
+import { C as FindExt, Ct as WhereInput, M as UpsertArgs, N as WriteArgs, S as DeleteExt, T as OffsetPageArgs, X as InferResult, Z as QuerySpec, _ as CursorPage, it as AggregateResult, j as UpdateArgs, k as Returned, l as CacheAdapter, lt as FindFirstArgs, rt as AggregateArgs, st as CountArgs, t as BetterSupabase, ut as FindManyArgs, v as CursorPageArgs, vt as Payload, w as OffsetPage, x as DeleteArgs, y as Db, yt as ReadArgs } from "./define-e3zI4_4g.js";
 import { DataTag, InfiniteData, QueryClient, SkipToken } from "@tanstack/query-core";
 //#region src/query/invalidate.d.ts
 /** Carried by every better-supabase query: the tables whose changes make it stale. */

package/dist/index.d.ts

@@ -1,15 +1,15 @@
-import { A as TableMeta, C as Relations, D as Simplify, E as SchemaMeta, M as UniqueKeyName, N as UniqueWhere, O as TableFlags, P as Update, S as RelationShape, T as Schema, _ as ModelsOf, a as CheckConstraint, b as RealtimeTableMeta, c as DatabaseOf, d as ForeignKeyConstraint, f as FunctionMeta, g as ModelShape, h as Insert, i as Casing, j as UniqueConstraint, k as TableKey, l as Flags, m as FunctionsOf, n as AnyModels, o as Codec, p as FunctionShape, r as BucketMeta, s as ColumnMeta, t as AnyFunctions, u as FlagsShape, v as PrimaryKeyColumn, w as Row, x as RelationMeta, y as PrimaryKeyValue } from "./types-C2fslP1z.js";
-import { C as and, E as or, S as UpdateOp, T as not, _ as OrderTerm, a as AggregateFn, b as SelectOp, c as Condition, d as FunctionSource, f as Include, g as Operation, h as MutationOp, i as RpcContext, l as CountMode, m as Measure, n as ExecuteResult, o as Aggregation, p as InsertOp, r as Executor, s as ColumnOp, t as ExecuteContext, u as DeleteOp, v as Quantifier, w as column, x as Selection, y as SelectColumn } from "./executor-Bazhgsgq.js";
+import { A as SchemaMeta, C as PrimaryKeyValue, D as Relations, E as RelationShape, F as UniqueConstraint, I as UniqueKeyName, L as UniqueWhere, M as TableFlags, N as TableKey, O as Row, P as TableMeta, R as Update, S as PrimaryKeyColumn, T as RelationMeta, _ as Insert, a as Casing, b as PermdockBucketPolicy, c as Codec, d as Flags, f as FlagsShape, g as FunctionsOf, h as FunctionShape, i as BucketPolicyName, j as Simplify, k as Schema, l as ColumnMeta, m as FunctionMeta, n as AnyModels, o as CheckConstraint, p as ForeignKeyConstraint, r as BucketMeta, s as ClaimsMeta, t as AnyFunctions, u as DatabaseOf, v as ModelShape, w as RealtimeTableMeta, x as PermdockTopicPolicy, y as ModelsOf } from "./types-C83v5SQz.js";
+import { C as and, E as or, S as UpdateOp, T as not, _ as OrderTerm, a as AggregateFn, b as SelectOp, c as Condition, d as FunctionSource, f as Include, g as Operation, h as MutationOp, i as RpcContext, l as CountMode, m as Measure, n as ExecuteResult, o as Aggregation, p as InsertOp, r as Executor, s as ColumnOp, t as ExecuteContext, u as DeleteOp, v as Quantifier, w as column, x as Selection, y as SelectColumn } from "./executor-CGdNQ27g.js";
 import { C as isConflict, D as statusOf, E as mapDbError, S as isCheck, T as isForeignKey, _ as DbException, a as Ok, b as ValidationIssue, c as err, d as toBetterResult, f as toDbError, g as DbErrorOf, h as DbErrorKinds, i as Err, l as fromBetterResult, m as DbErrorKind, n as BetterResultApi, o as Result, p as DbError, r as BetterResultShape, t as AsyncResult, u as ok, v as ErrorMapper, w as isDbError, x as dbError, y as RawDbError } from "./result-CTkCZ6JA.js";
-import { a as EventHub, c as QueryEvent, d as LogFields, f as Logger, i as EventHandler, l as RefreshEvent, m as silentLogger, n as BetterSupabaseEvents, o as EventName, p as consoleLogger, r as ErrorEvent, s as MutationNotice, t as AuthEvent, u as RpcNotice } from "./events-2OJsVG_d.js";
-import { $ as Specs, A as RpcOptions, B as ReadSet, C as FindExt, Ct as WhereInput, D as Repository, E as PageOf, F as EMPTY_STATS, G as ReadSetParams, H as ReadSetParamType, I as StatsRecorder, J as isReadSet, K as ReadSetResult, L as recordStats, M as UpsertArgs, N as WriteArgs, O as RepositoryOf, P as DbStats, Q as ReadMethod, R as SearchArgs, S as DeleteExt, St as SortDirection, T as OffsetPageArgs, U as ReadSetParamTypes, V as ReadSetOptions, W as ReadSetParamValue, X as InferResult, Y as readSetTables, Z as QuerySpec, _ as CursorPage, _t as OrderByInput, a as defineSupabase, at as AggregateRow, b as DbHelpers, bt as RelationMeasureArg, c as postgrestExecutor, ct as FieldFilter, d as MemoryCache, dt as IncludeArg, et as TableSpecs, f as cacheTargetOf, ft as IncludeArgs, g as ConflictTarget, gt as OrderByArg, h as rpcCacheTargets, ht as NumericMeasureArg, i as RpcDefinition, it as AggregateResult, j as UpdateArgs, k as Returned, l as CacheAdapter, lt as FindFirstArgs, m as rowKey, mt as MeasureKey, n as ConnectOptions, nt as specTables, o as PostgrestClientLike, ot as CountArg, p as memoryCache, pt as MeasureArg, q as defineReadSet, r as DefineSupabaseOptions, rt as AggregateArgs, s as explainPostgrest, st as CountArgs, t as BetterSupabase, tt as isQuerySpec, u as CacheTarget, ut as FindManyArgs, v as CursorPageArgs, vt as Payload, w as OffsetPage, x as DeleteArgs, xt as SelectArg, y as Db, yt as ReadArgs, z as InferReadSetParams } from "./define-CTfWw-SS.js";
-import { _ as definePlugin, a as ExtensionOf, c as MutationEvent, d as PLUGIN_API_VERSION, f as Plugin, g as WithExtension, h as RequestContext, i as CallOptions, l as MutationKind, m as RepositoryExtension, n as AnyPlugin, o as HasFlag, p as RepositoryApi, r as ApplyExtension, s as HookArgs, t as Actor, u as NoExtension } from "./plugin-HvGqCurB.js";
+import { a as EventHub, c as QueryEvent, d as LogFields, f as Logger, i as EventHandler, l as RefreshEvent, m as silentLogger, n as BetterSupabaseEvents, o as EventName, p as consoleLogger, r as ErrorEvent, s as MutationNotice, t as AuthEvent, u as RpcNotice } from "./events-DOt3nSO-.js";
+import { $ as Specs, A as RpcOptions, B as ReadSet, C as FindExt, Ct as WhereInput, D as Repository, E as PageOf, F as EMPTY_STATS, G as ReadSetParams, H as ReadSetParamType, I as StatsRecorder, J as isReadSet, K as ReadSetResult, L as recordStats, M as UpsertArgs, N as WriteArgs, O as RepositoryOf, P as DbStats, Q as ReadMethod, R as SearchArgs, S as DeleteExt, St as SortDirection, T as OffsetPageArgs, U as ReadSetParamTypes, V as ReadSetOptions, W as ReadSetParamValue, X as InferResult, Y as readSetTables, Z as QuerySpec, _ as CursorPage, _t as OrderByInput, a as defineSupabase, at as AggregateRow, b as DbHelpers, bt as RelationMeasureArg, c as postgrestExecutor, ct as FieldFilter, d as MemoryCache, dt as IncludeArg, et as TableSpecs, f as cacheTargetOf, ft as IncludeArgs, g as ConflictTarget, gt as OrderByArg, h as rpcCacheTargets, ht as NumericMeasureArg, i as RpcDefinition, it as AggregateResult, j as UpdateArgs, k as Returned, l as CacheAdapter, lt as FindFirstArgs, m as rowKey, mt as MeasureKey, n as ConnectOptions, nt as specTables, o as PostgrestClientLike, ot as CountArg, p as memoryCache, pt as MeasureArg, q as defineReadSet, r as DefineSupabaseOptions, rt as AggregateArgs, s as explainPostgrest, st as CountArgs, t as BetterSupabase, tt as isQuerySpec, u as CacheTarget, ut as FindManyArgs, v as CursorPageArgs, vt as Payload, w as OffsetPage, x as DeleteArgs, xt as SelectArg, y as Db, yt as ReadArgs, z as InferReadSetParams } from "./define-e3zI4_4g.js";
+import { _ as definePlugin, a as ExtensionOf, c as MutationEvent, d as PLUGIN_API_VERSION, f as Plugin, g as WithExtension, h as RequestContext, i as CallOptions, l as MutationKind, m as RepositoryExtension, n as AnyPlugin, o as HasFlag, p as RepositoryApi, r as ApplyExtension, s as HookArgs, t as Actor, u as NoExtension } from "./plugin-C4TR9J0Z.js";
 import { n as validate, t as StandardSchemaV1 } from "./standard-CyhRzctb.js";
-import { a as compilePostgrest, i as PostgrestPlan, n as PlanLimit, r as PlanOrder, t as PlanFilter } from "./postgrest-Dm-vhY6R.js";
+import { a as compilePostgrest, i as PostgrestPlan, n as PlanLimit, r as PlanOrder, t as PlanFilter } from "./postgrest-cAEQ_IQN.js";
 import { n as StoragePath } from "./path-Cv__-OTj.js";
-import { n as postgrestCompiler, t as Compiler } from "./compiler-DL18ukPe.js";
+import { n as postgrestCompiler, t as Compiler } from "./compiler-CZ9nIuqy.js";
 import { a as ProblemResponseOptions, c as problemResponse, i as ProblemOptions, l as toProblem, n as PROBLEM_TYPE_BASE, o as fromProblem, r as ProblemDetails, s as isProblem, t as PROBLEM_CONTENT_TYPE } from "./problem-DlgB0lYl.js";
-import { t as SPEC_PINS } from "./spec-pins-CJPVghHy.js";
+import { t as SPEC_PINS } from "./spec-pins-CqorWDnO.js";
 //#region src/core/define-repository.d.ts
 /** Adds `Methods` to the repository of `Table` only. */
 interface TableRepositoryExtension<Table extends string, Methods> extends RepositoryExtension {
@@ -107,4 +107,4 @@ export declare function toCamel(name: string): string;
 /** `firstName` to `first_name`. */
 export declare function toSnake(name: string): string;
 //#endregion
-export { type Actor, type AggregateArgs, type AggregateFn, type AggregateResult, type AggregateRow, type Aggregation, type AnyFunctions, type AnyModels, type AnyPlugin, type ApplyExtension, AsyncResult, type AuthEvent, type BetterResultApi, type BetterResultShape, BetterSupabase, type BetterSupabaseEvents, type BucketMeta, type CacheAdapter, type CacheTarget, type CallOptions, type Casing, type CheckConstraint, type Codec, type ColumnMeta, type ColumnOp, type Compiler, type Condition, type ConflictTarget, type ConnectOptions, type CountArg, type CountArgs, type CountMode, type CursorPage, type CursorPageArgs, type DatabaseOf, type Db, type DbError, type DbErrorKind, type DbErrorKinds, type DbErrorOf, DbException, type DbHelpers, type DbStats, type DefineSupabaseOptions, type DeleteArgs, type DeleteExt, type DeleteOp, EMPTY_STATS, type EnrichDatabase, type Err, type ErrorEvent, type ErrorMapper, type EventHandler, EventHub, type EventName, type ExecuteContext, type ExecuteResult, type Executor, type ExtensionOf, type FieldFilter, type FindExt, type FindFirstArgs, type FindManyArgs, type Flags, type FlagsShape, type ForeignKeyConstraint, type FunctionMeta, type FunctionShape, type FunctionSource, type FunctionsOf, type HasFlag, type HookArgs, type Include, type IncludeArg, type IncludeArgs, type InferReadSetParams, type InferResult, type Insert, type InsertOp, type LogFields, type Logger, type Measure, type MeasureArg, type MeasureKey, type MemoryCache, type ModelShape, type ModelsOf, type MutationEvent, type MutationKind, type MutationNotice, type MutationOp, type NoExtension, type NumericMeasureArg, type OffsetPage, type OffsetPageArgs, type Ok, type Operation, type OrderByArg, type OrderByInput, type OrderTerm, PLUGIN_API_VERSION, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, type PageOf, type Payload, type PlanFilter, type PlanLimit, type PlanOrder, type Plugin, type PostgrestClientLike, type PostgrestPlan, type PrimaryKeyColumn, type PrimaryKeyValue, type ProblemDetails, type ProblemOptions, type ProblemResponseOptions, type Quantifier, type QueryEvent, type QuerySpec, type RawDbError, type ReadArgs, type ReadMethod, type ReadSet, type ReadSetOptions, type ReadSetParamType, type ReadSetParamTypes, type ReadSetParamValue, type ReadSetParams, type ReadSetResult, type RealtimeTableMeta, type RefreshEvent, type RelationMeasureArg, type RelationMeta, type RelationShape, type Relations, type Repository, type RepositoryApi, type RepositoryExtension, type RepositoryOf, type RequestContext, type Result, type Returned, type Row, type RpcContext, type RpcDefinition, type RpcNotice, type RpcOptions, SPEC_PINS, type Schema, type SchemaMeta, type ScopeFor, type SearchArgs, type SelectArg, type SelectColumn, type SelectOp, type Selection, type Simplify, type SortDirection, type Specs, type StandardSchemaV1, StatsRecorder, type StoragePath, type TableFlags, type TableKey, type TableMeta, type TableRepositoryExtension, type TableSpecs, type UniqueConstraint, type UniqueKeyName, type UniqueWhere, type Update, type UpdateArgs, type UpdateOp, type UpsertArgs, type ValidationIssue, type WhereInput, type WithExtension, type WriteArgs, and, cacheTargetOf, column, compilePostgrest, consoleLogger, dbError, definePlugin, defineReadSet, defineSupabase, err, explainPostgrest, fromBetterResult, fromProblem, isCheck, isConflict, isDbError, isForeignKey, isProblem, isQuerySpec, isReadSet, mapDbError, memoryCache, not, ok, or, postgrestCompiler, postgrestExecutor, problemResponse, readSetTables, recordStats, rowKey, rpcCacheTargets, silentLogger, specTables, statusOf, toBetterResult, toDbError, toProblem, validate };
+export { type Actor, type AggregateArgs, type AggregateFn, type AggregateResult, type AggregateRow, type Aggregation, type AnyFunctions, type AnyModels, type AnyPlugin, type ApplyExtension, AsyncResult, type AuthEvent, type BetterResultApi, type BetterResultShape, BetterSupabase, type BetterSupabaseEvents, type BucketMeta, type BucketPolicyName, type CacheAdapter, type CacheTarget, type CallOptions, type Casing, type CheckConstraint, type ClaimsMeta, type Codec, type ColumnMeta, type ColumnOp, type Compiler, type Condition, type ConflictTarget, type ConnectOptions, type CountArg, type CountArgs, type CountMode, type CursorPage, type CursorPageArgs, type DatabaseOf, type Db, type DbError, type DbErrorKind, type DbErrorKinds, type DbErrorOf, DbException, type DbHelpers, type DbStats, type DefineSupabaseOptions, type DeleteArgs, type DeleteExt, type DeleteOp, EMPTY_STATS, type EnrichDatabase, type Err, type ErrorEvent, type ErrorMapper, type EventHandler, EventHub, type EventName, type ExecuteContext, type ExecuteResult, type Executor, type ExtensionOf, type FieldFilter, type FindExt, type FindFirstArgs, type FindManyArgs, type Flags, type FlagsShape, type ForeignKeyConstraint, type FunctionMeta, type FunctionShape, type FunctionSource, type FunctionsOf, type HasFlag, type HookArgs, type Include, type IncludeArg, type IncludeArgs, type InferReadSetParams, type InferResult, type Insert, type InsertOp, type LogFields, type Logger, type Measure, type MeasureArg, type MeasureKey, type MemoryCache, type ModelShape, type ModelsOf, type MutationEvent, type MutationKind, type MutationNotice, type MutationOp, type NoExtension, type NumericMeasureArg, type OffsetPage, type OffsetPageArgs, type Ok, type Operation, type OrderByArg, type OrderByInput, type OrderTerm, PLUGIN_API_VERSION, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, type PageOf, type Payload, type PermdockBucketPolicy, type PermdockTopicPolicy, type PlanFilter, type PlanLimit, type PlanOrder, type Plugin, type PostgrestClientLike, type PostgrestPlan, type PrimaryKeyColumn, type PrimaryKeyValue, type ProblemDetails, type ProblemOptions, type ProblemResponseOptions, type Quantifier, type QueryEvent, type QuerySpec, type RawDbError, type ReadArgs, type ReadMethod, type ReadSet, type ReadSetOptions, type ReadSetParamType, type ReadSetParamTypes, type ReadSetParamValue, type ReadSetParams, type ReadSetResult, type RealtimeTableMeta, type RefreshEvent, type RelationMeasureArg, type RelationMeta, type RelationShape, type Relations, type Repository, type RepositoryApi, type RepositoryExtension, type RepositoryOf, type RequestContext, type Result, type Returned, type Row, type RpcContext, type RpcDefinition, type RpcNotice, type RpcOptions, SPEC_PINS, type Schema, type SchemaMeta, type ScopeFor, type SearchArgs, type SelectArg, type SelectColumn, type SelectOp, type Selection, type Simplify, type SortDirection, type Specs, type StandardSchemaV1, StatsRecorder, type StoragePath, type TableFlags, type TableKey, type TableMeta, type TableRepositoryExtension, type TableSpecs, type UniqueConstraint, type UniqueKeyName, type UniqueWhere, type Update, type UpdateArgs, type UpdateOp, type UpsertArgs, type ValidationIssue, type WhereInput, type WithExtension, type WriteArgs, and, cacheTargetOf, column, compilePostgrest, consoleLogger, dbError, definePlugin, defineReadSet, defineSupabase, err, explainPostgrest, fromBetterResult, fromProblem, isCheck, isConflict, isDbError, isForeignKey, isProblem, isQuerySpec, isReadSet, mapDbError, memoryCache, not, ok, or, postgrestCompiler, postgrestExecutor, problemResponse, readSetTables, recordStats, rowKey, rpcCacheTargets, silentLogger, specTables, statusOf, toBetterResult, toDbError, toProblem, validate };

package/dist/index.js

@@ -1,15 +1,16 @@
 import { a as isConflict, c as mapDbError, i as isCheck, l as statusOf, n as dbError, o as isDbError, s as isForeignKey, t as DbException } from "./errors-Bl3rkOzo.js";
-import { i as escapeLike, l as defineSchema, o as decodeRows, s as encodeValue, t as simplify, u as tableMeta } from "./simplify-oHiDKRVQ.js";
+import { i as escapeLike, l as defineSchema, o as decodeRows, s as encodeValue, t as simplify, u as tableMeta } from "./simplify-bwJpLnaS.js";
 import { i as or, n as column, r as not, t as and } from "./types-6cYK9pbJ.js";
 import { a as toBetterResult, i as ok, n as err, o as toDbError, r as fromBetterResult, t as AsyncResult } from "./result-DWXatkd6.js";
-import { a as EventHub, c as cacheTargetOf, d as rpcCacheTargets, i as encodeCursor, l as memoryCache, n as defineSupabase, o as consoleLogger, r as decodeCursor, s as silentLogger, t as BetterSupabase, u as rowKey } from "./define-QGkq04oe.js";
+import { a as EventHub, c as rowKey, i as encodeCursor, l as rpcCacheTargets, n as defineSupabase, o as cacheTargetOf, r as decodeCursor, s as memoryCache, t as BetterSupabase } from "./define-BXMYD9AY.js";
 import { n as touchedTables, t as invalidationTargets } from "./tables-rZxRxNPW.js";
+import { n as silentLogger, t as consoleLogger } from "./logger-glM28NVN.js";
 import { n as definePlugin, t as PLUGIN_API_VERSION } from "./plugin-BqR6wKMB.js";
-import { a as postgrestExecutor, i as explainPostgrest, n as StatsRecorder, o as compilePostgrest, r as recordStats, t as EMPTY_STATS } from "./stats-3iy8u3_P.js";
-import { c as readSetTables, d as isQuerySpec, f as specTables, i as defineReadSet, o as isReadSet } from "./read-set-DhX2d04c.js";
+import { a as postgrestExecutor, i as explainPostgrest, n as StatsRecorder, o as compilePostgrest, r as recordStats, t as EMPTY_STATS } from "./stats-C5W-rBfR.js";
+import { c as readSetTables, d as isQuerySpec, f as specTables, i as defineReadSet, o as isReadSet } from "./read-set-4lI3W_gZ.js";
 import { t as validate } from "./standard-FUi3Z3-7.js";
-import { a as problemResponse, i as isProblem, n as PROBLEM_TYPE_BASE, o as toProblem, r as fromProblem, t as PROBLEM_CONTENT_TYPE } from "./problem-DPu6Fh-t.js";
-import { t as SPEC_PINS } from "./spec-pins-t6sPaHvl.js";
+import { a as problemResponse, i as isProblem, n as PROBLEM_TYPE_BASE, o as toProblem, r as fromProblem, t as PROBLEM_CONTENT_TYPE } from "./problem-BTkTtRV9.js";
+import { t as SPEC_PINS } from "./spec-pins-C3oc-Tdp.js";
 import { n as scopeOperation, r as scopeSelection, t as scopeCondition } from "./scope-CDHcS7dE.js";
 import { n as toCamel, r as toSnake } from "./casing-da0uRTqt.js";
 //#region src/core/define-repository.ts

package/dist/jobs/index.d.ts

@@ -1,5 +1,5 @@
 import { o as Result, p as DbError, t as AsyncResult } from "../result-CTkCZ6JA.js";
-import { t as SqlClient } from "../executor-Bje4suQF.js";
+import { t as SqlClient } from "../executor-BYXQ9AGn.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/jobs/index.d.ts
 export type QueueSchemas = Readonly<Record<string, StandardSchemaV1>>;

package/dist/jobs/index.js

@@ -1,9 +1,9 @@
 import { c as mapDbError, n as dbError, t as DbException } from "../errors-Bl3rkOzo.js";
 import { i as ok, n as err, o as toDbError, t as AsyncResult } from "../result-DWXatkd6.js";
 import { t as validate } from "../standard-FUi3Z3-7.js";
-import { a as problemResponse } from "../problem-DPu6Fh-t.js";
-import { t as fromPgError } from "../executor-Ceq60hPM.js";
-import { c as verifyWebhook } from "../webhooks-DbMTJJX2.js";
+import { a as problemResponse } from "../problem-BTkTtRV9.js";
+import { t as fromPgError } from "../executor-DeppvirK.js";
+import { c as verifyWebhook } from "../webhooks-DMipjhSP.js";
 //#region src/jobs/index.ts
 function run(fn) {
 	return AsyncResult.from(async () => {
@@ -102,7 +102,7 @@ function postgrestTransport(client) {
 	const call = async (fn, args) => {
 		const { data, error } = await client.schema("pgmq_public").rpc(fn, args);
 		if (error) {
-			const message = typeof error === "object" && error !== null && "message" in error ? String(error.message) : String(error);
+			const message = typeof error === "object" && "message" in error ? String(error.message) : String(error);
 			throw new Error(`pgmq_public.${fn}: ${message}`, { cause: error });
 		}
 		return data;
@@ -458,7 +458,8 @@ function createInbox(sql, options) {
 /** The Stripe event sent when a customer's active entitlements change. */
 const ENTITLEMENTS_UPDATED = "entitlements.active_entitlement_summary.updated";
 function stripeCustomerOf(payload) {
-	const customer = (payload?.data?.object)?.customer;
+	if (typeof payload !== "object" || payload === null) return void 0;
+	const customer = (payload.data?.object)?.customer;
 	if (typeof customer === "string") return customer;
 	const id = customer?.id;
 	return typeof id === "string" ? id : void 0;

package/dist/{json-schema-BbwO2mZg.js → json-schema-BpYqkCKf.js}

@@ -1,3 +1,4 @@
+import { t as isList } from "./guards-BnzDvFrz.js";
 //#region src/generators/shared.ts
 const INTEGER = /* @__PURE__ */ new Set([
 	"int2",
@@ -132,7 +133,7 @@ function property(plan) {
 	if (!plan.nullable) return schema;
 	if (Object.keys(schema).length === 0) return schema;
 	const { enum: values, ...rest } = schema;
-	if (Array.isArray(values)) return {
+	if (isList(values)) return {
 		...rest,
 		type: ["string", "null"],
 		enum: [...values, null]

package/dist/list/index.d.ts

@@ -1,2 +1,2 @@
-import { a as ListPage, c as ListQuery, d as ListSearchParams, f as OpenApiParameter, h as defineListQuery, i as ListExtra, l as ListQueryConfig, m as UNSET, n as FacetInfo, o as ListParseResult, p as ParserSpec, r as ListDefinition, s as ListParsers, t as FacetCounts, u as ListQueryInput } from "../index-JXHBuS53.js";
+import { a as ListPage, c as ListQuery, d as ListSearchParams, f as OpenApiParameter, h as defineListQuery, i as ListExtra, l as ListQueryConfig, m as UNSET, n as FacetInfo, o as ListParseResult, p as ParserSpec, r as ListDefinition, s as ListParsers, t as FacetCounts, u as ListQueryInput } from "../index-Bw1bwtC0.js";
 export { FacetCounts, FacetInfo, ListDefinition, ListExtra, ListPage, ListParseResult, ListParsers, ListQuery, ListQueryConfig, ListQueryInput, ListSearchParams, OpenApiParameter, ParserSpec, UNSET, defineListQuery };

package/dist/{live-6b9i72Ux.d.ts → live-DJyZMD6w.d.ts}

@@ -1,6 +1,6 @@
-import { E as SchemaMeta, k as TableKey, n as AnyModels, t as AnyFunctions, w as Row } from "./types-C2fslP1z.js";
+import { A as SchemaMeta, N as TableKey, O as Row, n as AnyModels, t as AnyFunctions, x as PermdockTopicPolicy } from "./types-C83v5SQz.js";
 import { b as ValidationIssue, o as Result, p as DbError, t as AsyncResult } from "./result-CTkCZ6JA.js";
-import { Z as QuerySpec, t as BetterSupabase } from "./define-CTfWw-SS.js";
+import { Z as QuerySpec, t as BetterSupabase } from "./define-e3zI4_4g.js";
 import { n as TemplateValues, t as TemplateParams } from "./template-mbvlysOo.js";
 import { RealtimeChannel, SupabaseClient } from "@supabase/supabase-js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
@@ -15,7 +15,7 @@ interface TopicOptions<E extends EventSchemas> {
   readonly private?: boolean;
   /**
    * Tenant check for the generated policy. Defaults to `{orgId}` against
-   * `org_id` / `app_metadata.org_id` when the template has `{orgId}`.
+   * `tenant_id` / `app_metadata.tenant_id` when the template has `{orgId}`.
    */
   readonly tenant?: false | {
     readonly param?: string;
@@ -26,6 +26,17 @@ interface TopicOptions<E extends EventSchemas> {
   readonly owner?: false | {
     readonly param?: string;
   };
+  /**
+   * Authorize with PermDock's SQL helpers instead of the tenant claim:
+   * `permitted_<scope>_ids(receive)` on the scope segment (or
+   * `permdock_has` for `scope: 'global'`), and `send` for broadcasting.
+   *
+   * The helpers check role and scope only. Use this just for permissions
+   * whose grants have no row conditions beyond the scope: for a permission
+   * with row conditions (e.g. `authorId = principal.id`) every member of the
+   * scope may join. Leave those to the policies `permdock rls generate` writes.
+   */
+  readonly permdock?: PermdockTopicPolicy;
   /** Let clients broadcast on the topic, not only receive. Defaults to `false`. */
   readonly send?: boolean;
   /** Also authorize presence. Defaults to `false`. */

package/dist/logger-glM28NVN.js

@@ -0,0 +1,21 @@
+//#region src/core/logger.ts
+const log = (method) => (message, fields) => {
+	if (fields === void 0) console[method](`better-supabase: ${message}`);
+	else console[method](`better-supabase: ${message}`, fields);
+};
+/** The default: `console`, with a `better-supabase:` prefix. */
+const consoleLogger = {
+	debug: log("debug"),
+	info: log("info"),
+	warn: log("warn"),
+	error: log("error")
+};
+const noop = () => {};
+const silentLogger = {
+	debug: noop,
+	info: noop,
+	warn: noop,
+	error: noop
+};
+//#endregion
+export { silentLogger as n, consoleLogger as t };

package/dist/mcp/index.d.ts

@@ -1,7 +1,7 @@
-import { k as TableKey, n as AnyModels, t as AnyFunctions } from "../types-C2fslP1z.js";
-import { t as BetterSupabase } from "../define-CTfWw-SS.js";
-import { d as ServerContext, f as ServerOptions, l as BetterServer, n as GuardOptions } from "../respond-PoTpy5DT.js";
-import { i as ResourceRouteOptions } from "../resource-SkPTRJDD.js";
+import { N as TableKey, n as AnyModels, t as AnyFunctions } from "../types-C83v5SQz.js";
+import { t as BetterSupabase } from "../define-e3zI4_4g.js";
+import { d as ServerContext, f as ServerOptions, l as BetterServer, n as GuardOptions } from "../respond-Dne1ARSa.js";
+import { i as ResourceRouteOptions } from "../resource-CgZa3YG_.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/mcp/index.d.ts
 export declare const MCP_PROTOCOL_VERSION: string;
@@ -31,8 +31,25 @@ export interface McpTool<M extends AnyModels, F extends AnyFunctions, E> {
   readonly info: ToolInfo;
   /** Validates arguments; its output is what `run` receives. */
   readonly input?: StandardSchemaV1;
+  /** Opaque data for the `authorize` and `visible` hooks. Never sent to clients. */
+  readonly meta?: unknown;
   run(args: never, ctx: ToolContext<M, F, E>): unknown;
 }
+/** What the `authorize` and `visible` hooks see of a tool. */
+export interface ToolRef {
+  readonly info: ToolInfo;
+  /** The tool's `meta`, e.g. a PermDock permission. `undefined` for table tools. */
+  readonly meta: unknown;
+}
+/** The outcome of `authorize`. `scopes` turns a refusal into an OAuth challenge. */
+export type ToolDecision = {
+  readonly allowed: true;
+} | {
+  readonly allowed: false;
+  readonly reason?: string;
+  /** OAuth scopes the call needs, sent in an `insufficient_scope` challenge. */
+  readonly scopes?: readonly string[];
+};
 export interface ToolDefinition<M extends AnyModels, F extends AnyFunctions, E, I> {
   readonly name: string;
   readonly title?: string;
@@ -45,6 +62,8 @@ export interface ToolDefinition<M extends AnyModels, F extends AnyFunctions, E,
   readonly inputSchema?: Json;
   readonly outputSchema?: Json;
   readonly annotations?: ToolAnnotations;
+  /** Opaque data for the `authorize` and `visible` hooks. Never sent to clients. */
+  readonly meta?: unknown;
   run(args: I, ctx: ToolContext<M, F, E>): unknown;
 }
 export type ToolResources<M extends AnyModels> = { readonly [T in TableKey<M>]?: ResourceRouteOptions<M, T> | true; };
@@ -64,12 +83,30 @@ export interface McpOptions<M extends AnyModels, F extends AnyFunctions, E> exte
   readonly resource?: string | ((request: Request) => string);
   /** Defaults to Supabase Auth of `env.url` (`<url>/auth/v1`). */
   readonly authorizationServers?: readonly string[];
+  /**
+   * Scopes the tools need, published as RFC 9728 `scopes_supported` and in
+   * `insufficient_scope` challenges. `offline_access` is left out: refresh
+   * tokens are between the client and the authorization server.
+   */
+  readonly scopes?: readonly string[];
   /** Origins allowed to call the server (DNS rebinding protection). Defaults to any. */
   readonly allowedOrigins?: readonly string[];
   /** Custom jsonb types, as in `createOpenApi`. */
   readonly json?: Readonly<Record<string, unknown>>;
   /** Include internal error messages in tool results. Defaults to `NODE_ENV === 'development'`. */
   readonly exposeErrors?: boolean;
+  /**
+   * Decides each `tools/call` after the arguments are validated and before
+   * `run`. `args` are the validated arguments (raw for table tools, which
+   * validate in the repository). A refusal is a tool error; a refusal with
+   * `scopes` is a 403 `insufficient_scope` challenge naming them.
+   */
+  readonly authorize?: (ctx: ToolContext<M, F, E>, tool: ToolRef, args: unknown) => ToolDecision | Promise<ToolDecision>;
+  /**
+   * Whether the caller sees a tool in `tools/list`. A hidden tool is called
+   * like an unknown one. Lists are cached per token (`cacheScope: 'private'`).
+   */
+  readonly visible?: (ctx: ToolContext<M, F, E>, tool: ToolRef) => boolean | Promise<boolean>;
 }
 export interface BetterMcp<M extends AnyModels, F extends AnyFunctions, E> extends BetterServer<M, F, E> {
   /** Everything in one handler: the MCP endpoint and `/.well-known/oauth-protected-resource`. */