better-supabase 0.1.0 → 0.2.0

package/dist/mcp/index.js

@@ -1,15 +1,21 @@
 import { n as dbError } from "../errors-Bl3rkOzo.js";
 import { t as validate } from "../standard-FUi3Z3-7.js";
-import { o as toProblem } from "../problem-DPu6Fh-t.js";
-import { t as SPEC_PINS } from "../spec-pins-t6sPaHvl.js";
-import { t as buildJsonSchema } from "../json-schema-BbwO2mZg.js";
-import { a as settle, c as withExtra, n as guard, o as createServer, s as extendServer, t as defaultExpose } from "../respond-4-dhoV7x.js";
-import { t as defineResource } from "../resource-CYiu6Ygi.js";
-import { fromSupabaseUrl, resourceMetadataResponse, unauthorizedResponse } from "@supabase/server/oauth-protected-resource";
+import { o as toProblem } from "../problem-BTkTtRV9.js";
+import { t as SPEC_PINS } from "../spec-pins-C3oc-Tdp.js";
+import { t as buildJsonSchema } from "../json-schema-BpYqkCKf.js";
+import { a as settle, c as withExtra, n as guard, o as createServer, s as extendServer, t as defaultExpose } from "../respond-DMcbQwfN.js";
+import { t as defineResource } from "../resource-BHEWmQJK.js";
+import { fromSupabaseUrl, unauthorizedResponse } from "@supabase/server/oauth-protected-resource";
 //#region src/mcp/index.ts
 const MCP_PROTOCOL_VERSION = SPEC_PINS.mcp;
 const WELL_KNOWN = "/.well-known/oauth-protected-resource";
-const SUPPORTED_VERSIONS = /* @__PURE__ */ new Set([MCP_PROTOCOL_VERSION, "2025-03-26"]);
+/** Revisions before 2026-07-28 open with an `initialize` handshake. */
+const LEGACY_VERSIONS = [
+	"2025-11-25",
+	"2025-06-18",
+	"2025-03-26"
+];
+const SUPPORTED_VERSIONS = [MCP_PROTOCOL_VERSION, ...LEGACY_VERSIONS];
 /** A custom tool. Pass it in `createMcp({ tools: [...] })`. */
 function defineTool(definition) {
 	if (!/^[A-Za-z0-9_.-]{1,64}$/.test(definition.name)) throw new TypeError(`Invalid tool name "${definition.name}": use 1-64 letters, digits, "_", "-" or "."`);
@@ -30,6 +36,7 @@ function defineTool(definition) {
 			...definition.annotations ? { annotations: definition.annotations } : {}
 		},
 		...definition.input ? { input: definition.input } : {},
+		...definition.meta === void 0 ? {} : { meta: definition.meta },
 		run: (args, ctx) => definition.run(args, ctx)
 	};
 }
@@ -143,18 +150,38 @@ const PARSE_ERROR = -32700;
 const INVALID_REQUEST = -32600;
 const METHOD_NOT_FOUND = -32601;
 const INVALID_PARAMS = -32602;
-function rpcError(id, code, message, status = 200) {
+const HEADER_MISMATCH = -32020;
+const UNSUPPORTED_PROTOCOL_VERSION = -32022;
+const META_VERSION = "io.modelcontextprotocol/protocolVersion";
+const META_CAPABILITIES = "io.modelcontextprotocol/clientCapabilities";
+const META_SERVER_INFO = "io.modelcontextprotocol/serverInfo";
+/** How long clients may cache `tools/list` and `server/discover` (per token). */
+const LIST_TTL_MS = 3e5;
+function rpcError(id, code, message, status = 200, data) {
 	return Response.json({
 		jsonrpc: "2.0",
 		id: id ?? null,
 		error: {
 			code,
-			message
+			message,
+			...data ? { data } : {}
 		}
 	}, { status });
 }
+const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/** An `Mcp-Name` value, decoding the `=?base64?...?=` sentinel. */
+function headerName(value) {
+	const encoded = /^=\?base64\?(.*)\?=$/.exec(value)?.[1];
+	if (encoded === void 0) return value;
+	try {
+		return new TextDecoder().decode(Uint8Array.from(atob(encoded), (char) => char.charCodeAt(0)));
+	} catch {
+		return value;
+	}
+}
+const quoted = (value) => `"${value.replaceAll("\\", "\\\\").replaceAll("\"", "\\\"")}"`;
 function isRpcRequest(value) {
-	return typeof value === "object" && value !== null && value["jsonrpc"] === "2.0" && typeof value["method"] === "string";
+	return isObject(value) && value["jsonrpc"] === "2.0" && typeof value["method"] === "string" && (value["params"] === void 0 || isObject(value["params"]));
 }
 function textResult(value, isError = false) {
 	const structured = typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
@@ -185,43 +212,75 @@ function createMcp(sb, options) {
 		config: { json: options.json ?? {} }
 	})["$defs"];
 	const registry = /* @__PURE__ */ new Map();
-	const register = (info, call) => {
-		if (registry.has(info.name)) throw new TypeError(`Duplicate MCP tool "${info.name}"`);
-		registry.set(info.name, {
-			info,
-			call
-		});
+	const register = (entry) => {
+		if (registry.has(entry.info.name)) throw new TypeError(`Duplicate MCP tool "${entry.info.name}"`);
+		registry.set(entry.info.name, entry);
 	};
 	const failure = (error) => textResult(toProblem(error, { expose }), true);
+	const refused = async (tool, args, ctx) => {
+		if (!options.authorize) return void 0;
+		const decision = await options.authorize(ctx, tool, args);
+		if (decision.allowed) return void 0;
+		return {
+			refusal: decision.reason ?? `Not allowed to call ${tool.info.name}`,
+			scopes: decision.scopes ?? []
+		};
+	};
+	const isVisible = async (tool, ctx) => !options.visible || options.visible(ctx, tool);
 	for (const [table, raw] of Object.entries(options.resources ?? {})) {
 		if (!raw) continue;
 		const resource = defineResource(sb, table, raw === true ? {} : raw);
-		for (const { info, operation } of tableTools(resource, defs)) register(info, async (args, ctx) => {
-			const input = args ?? {};
-			const id = resource.keyParam ? input[resource.keyParam] : void 0;
-			const result = await resource.execute(ctx.db, operation, {
-				id,
-				query: input,
-				data: operation === "update" ? input["patch"] : input
+		for (const { info, operation } of tableTools(resource, defs)) {
+			const ref = {
+				info,
+				meta: void 0
+			};
+			register({
+				...ref,
+				async call(args, ctx) {
+					const input = args ?? {};
+					const refusal = await refused(ref, input, ctx);
+					if (refusal) return refusal;
+					const id = resource.keyParam ? input[resource.keyParam] : void 0;
+					const result = await resource.execute(ctx.db, operation, {
+						id,
+						query: input,
+						data: operation === "update" ? input["patch"] : input
+					});
+					if (!result.ok) return failure(result.error);
+					return textResult(operation === "delete" ? { deleted: true } : result.data);
+				}
 			});
-			if (!result.ok) return failure(result.error);
-			return textResult(operation === "delete" ? { deleted: true } : result.data);
-		});
+		}
 	}
 	const addTool = (tool) => {
-		register(tool.info, async (args, ctx) => {
-			let value = args ?? {};
-			if (tool.input) {
-				const parsed = await validate(tool.input, value, "arguments");
-				if (!parsed.ok) return failure(parsed.error);
-				value = parsed.data;
+		const ref = {
+			info: tool.info,
+			meta: tool.meta
+		};
+		register({
+			...ref,
+			async call(args, ctx) {
+				let value = args ?? {};
+				if (tool.input) {
+					const parsed = await validate(tool.input, value, "arguments");
+					if (!parsed.ok) return failure(parsed.error);
+					value = parsed.data;
+				}
+				const refusal = await refused(ref, value, ctx);
+				if (refusal) return refusal;
+				const outcome = await settle(() => tool.run(value, ctx));
+				return outcome.ok ? textResult(outcome.data) : failure(outcome.error);
 			}
-			const outcome = await settle(() => tool.run(value, ctx));
-			return outcome.ok ? textResult(outcome.data) : failure(outcome.error);
 		});
 	};
 	for (const tool of options.tools ?? []) addTool(tool);
 	const listTools = () => [...registry.values()].map((entry) => entry.info);
+	const visibleTools = async (ctx) => {
+		const entries = [...registry.values()];
+		const shown = await Promise.all(entries.map((entry) => isVisible(entry, ctx)));
+		return entries.filter((_, index) => shown[index]).map((e) => e.info);
+	};
 	const authorizationServers = () => options.authorizationServers ?? [fromSupabaseUrl(server.env.url)];
 	const resourceOf = (request) => {
 		if (typeof options.resource === "function") return options.resource(request);
@@ -233,15 +292,63 @@ function createMcp(sb, options) {
 		const resource = new URL(resourceOf(request));
 		return `${resource.origin}${WELL_KNOWN}${resource.pathname.replace(/\/$/, "")}`;
 	};
-	const call = async (name, args, ctx) => {
+	const invoke = async (name, args, ctx, checkVisible = true) => {
 		const entry = registry.get(name);
-		if (!entry) return failure(dbError("not_found", `Unknown tool "${name}"`));
 		try {
+			if (!entry || checkVisible && !await isVisible(entry, ctx)) return failure(dbError("not_found", `Unknown tool "${name}"`));
 			return await entry.call(args, ctx);
 		} catch (cause) {
 			return failure(dbError("unexpected", expose && cause instanceof Error ? cause.message : "The tool failed"));
 		}
 	};
+	const isRefusal = (value) => "refusal" in value;
+	const call = async (name, args, ctx) => {
+		const outcome = await invoke(name, args, ctx);
+		return isRefusal(outcome) ? failure(dbError("forbidden", outcome.refusal)) : outcome;
+	};
+	const scopes = (options.scopes ?? []).filter((scope) => scope !== "offline_access");
+	const serverInfo = {
+		name: options.name,
+		version: options.version,
+		...options.title ? { title: options.title } : {}
+	};
+	const capabilities = { tools: { listChanged: false } };
+	const unauthorized = (request) => {
+		const response = unauthorizedResponse(request, { resourceMetadataUrl: metadataUrl(request) });
+		if (scopes.length > 0) response.headers.set("www-authenticate", `${response.headers.get("www-authenticate") ?? "Bearer"}, scope=${quoted(scopes.join(" "))}`);
+		return response;
+	};
+	const forbidden = (request, message, needed = [], id = null) => {
+		const all = [.../* @__PURE__ */ new Set([...scopes, ...needed])];
+		const challenge = [
+			"Bearer error=\"insufficient_scope\"",
+			`error_description=${quoted(message)}`,
+			...all.length > 0 ? [`scope=${quoted(all.join(" "))}`] : [],
+			`resource_metadata=${quoted(metadataUrl(request))}`
+		].join(", ");
+		const response = rpcError(id, INVALID_REQUEST, message, 403);
+		response.headers.set("www-authenticate", challenge);
+		return response;
+	};
+	const unsupportedVersion = (id, requested) => rpcError(id, UNSUPPORTED_PROTOCOL_VERSION, "Unsupported protocol version", 400, {
+		supported: [...SUPPORTED_VERSIONS],
+		requested
+	});
+	/** 2026-07-28 requests carry their version and capabilities, mirrored in headers. */
+	const checkModern = (message, header, headers) => {
+		const meta = message.params?.["_meta"];
+		const version = isObject(meta) ? meta[META_VERSION] : void 0;
+		if (!isObject(meta) || typeof version !== "string" || !isObject(meta[META_CAPABILITIES])) return rpcError(message.id, INVALID_PARAMS, `Requests need _meta["${META_VERSION}"] and _meta["${META_CAPABILITIES}"]`, 400);
+		if (version !== MCP_PROTOCOL_VERSION) return unsupportedVersion(message.id, version);
+		const mismatch = (detail) => rpcError(message.id, HEADER_MISMATCH, `Header mismatch: ${detail}`, 400);
+		if (header !== version) return mismatch(`MCP-Protocol-Version must be ${version}`);
+		if (headers.get("mcp-method") !== message.method) return mismatch(`Mcp-Method must be ${message.method}`);
+		const name = message.params?.["name"];
+		if (message.method === "tools/call" && typeof name === "string") {
+			const sent = headers.get("mcp-name");
+			if (sent === null || headerName(sent) !== name) return mismatch(`Mcp-Name must be ${name}`);
+		}
+	};
 	const handler = async (request) => {
 		const origin = request.headers.get("origin");
 		if (origin && options.allowedOrigins && !options.allowedOrigins.includes(origin)) return rpcError(null, INVALID_REQUEST, "Origin not allowed", 403);
@@ -249,14 +356,11 @@ function createMcp(sb, options) {
 			status: 405,
 			headers: { allow: "POST" }
 		});
-		const version = request.headers.get("mcp-protocol-version");
-		if (version && !SUPPORTED_VERSIONS.has(version)) return rpcError(null, INVALID_REQUEST, `Unsupported MCP-Protocol-Version ${version}`, 400);
+		const header = request.headers.get("mcp-protocol-version");
+		if (header && !SUPPORTED_VERSIONS.includes(header)) return unsupportedVersion(null, header);
 		const ctx = await server.context(request);
 		const denied = guard(ctx.auth, options.allow, options.aal);
-		if (denied) {
-			if (denied.kind === "unauthorized") return unauthorizedResponse(request, { resourceMetadataUrl: metadataUrl(request) });
-			return rpcError(null, INVALID_REQUEST, denied.message, 403);
-		}
+		if (denied) return denied.kind === "unauthorized" ? unauthorized(request) : forbidden(request, denied.message);
 		let message;
 		try {
 			message = await request.json();
@@ -264,43 +368,72 @@ function createMcp(sb, options) {
 			return rpcError(null, PARSE_ERROR, "Parse error", 400);
 		}
 		if (!isRpcRequest(message)) return rpcError(null, INVALID_REQUEST, "Expected one JSON-RPC 2.0 message", 400);
+		const meta = message.params?.["_meta"];
+		const modern = isObject(meta) && meta[META_VERSION] !== void 0 || header === MCP_PROTOCOL_VERSION;
+		if (modern) {
+			const invalid = checkModern(message, header, request.headers);
+			if (invalid) return invalid;
+		}
 		if (message.id === void 0) return new Response(null, { status: 202 });
+		const toolContext = () => withExtra(ctx, {
+			request,
+			signal: request.signal
+		});
 		const reply = (result) => Response.json({
 			jsonrpc: "2.0",
 			id: message.id,
-			result
+			result: modern ? {
+				...result,
+				resultType: "complete",
+				_meta: { [META_SERVER_INFO]: serverInfo }
+			} : result
 		});
+		const notFound = () => rpcError(message.id, METHOD_NOT_FOUND, `Method not found: ${message.method}`, modern ? 404 : 200);
 		switch (message.method) {
+			case "server/discover": return reply({
+				supportedVersions: [...SUPPORTED_VERSIONS],
+				capabilities,
+				...options.instructions ? { instructions: options.instructions } : {},
+				ttlMs: LIST_TTL_MS,
+				cacheScope: "private"
+			});
 			case "initialize": {
+				if (modern) return notFound();
 				const requested = message.params?.["protocolVersion"];
 				return reply({
-					protocolVersion: typeof requested === "string" && SUPPORTED_VERSIONS.has(requested) ? requested : MCP_PROTOCOL_VERSION,
-					capabilities: { tools: { listChanged: false } },
-					serverInfo: {
-						name: options.name,
-						version: options.version,
-						...options.title ? { title: options.title } : {}
-					},
+					protocolVersion: typeof requested === "string" && LEGACY_VERSIONS.includes(requested) ? requested : LEGACY_VERSIONS[0],
+					capabilities,
+					serverInfo,
 					...options.instructions ? { instructions: options.instructions } : {}
 				});
 			}
-			case "ping": return reply({});
-			case "tools/list": return reply({ tools: listTools() });
+			case "ping": return modern ? notFound() : reply({});
+			case "tools/list": return reply({
+				tools: await visibleTools(toolContext()),
+				...modern ? {
+					ttlMs: LIST_TTL_MS,
+					cacheScope: "private"
+				} : {}
+			});
 			case "tools/call": {
 				const name = message.params?.["name"];
-				if (typeof name !== "string" || !registry.has(name)) return rpcError(message.id, INVALID_PARAMS, `Unknown tool ${JSON.stringify(name)}`);
-				return reply(await call(name, message.params?.["arguments"], withExtra(ctx, {
-					request,
-					signal: request.signal
-				})));
+				const entry = typeof name === "string" ? registry.get(name) : void 0;
+				const context = toolContext();
+				if (!entry || !await isVisible(entry, context)) return rpcError(message.id, INVALID_PARAMS, `Unknown tool ${JSON.stringify(name)}`);
+				const outcome = await invoke(entry.info.name, message.params?.["arguments"], context, false);
+				if (!isRefusal(outcome)) return reply(outcome);
+				if (outcome.scopes.length > 0) return forbidden(request, outcome.refusal, outcome.scopes, message.id);
+				return reply(failure(dbError("forbidden", outcome.refusal)));
 			}
-			default: return rpcError(message.id, METHOD_NOT_FOUND, `Method not found: ${message.method}`);
+			default: return notFound();
 		}
 	};
-	const metadata = (request) => resourceMetadataResponse(request, {
+	const metadata = (request) => Response.json({
 		resource: resourceOf(request),
-		authorizationServers: [...authorizationServers()]
-	});
+		authorization_servers: [...authorizationServers()],
+		bearer_methods_supported: ["header"],
+		...scopes.length > 0 ? { scopes_supported: scopes } : {}
+	}, { headers: { "access-control-allow-origin": "*" } });
 	const mcp = extendServer(server, {
 		get tools() {
 			return listTools();

package/dist/{mfa-CpogP66z.js → mfa-CpLfJSde.js}

@@ -1,4 +1,5 @@
 import { n as dbError } from "./errors-Bl3rkOzo.js";
+import { t as consoleLogger } from "./logger-glM28NVN.js";
 import { DEFAULT_COOKIE_OPTIONS, createChunks, isChunkLike, parseCookieHeader, serializeCookieHeader, stringFromBase64URL, stringToBase64URL } from "@supabase/ssr";
 import { extractCredentials, verifyCredentials } from "@supabase/server/core";
 //#region src/auth/impersonation.ts
@@ -257,7 +258,7 @@ async function verify(credentials, modes, options, source) {
 	const memo = token ? memoFor(options) : void 0;
 	if (token && memo) {
 		const hit = remembered(memo, token, Math.floor((options.now ?? Date.now)() / 1e3));
-		if (hit) return checkClaims({
+		if (hit) return checkUser({
 			...hit,
 			source
 		}, options);
@@ -270,7 +271,7 @@ async function verify(credentials, modes, options, source) {
 		user: state.user,
 		expiresAt: state.expiresAt
 	});
-	return checkClaims(state, options);
+	return checkUser(state, options);
 }
 /** Validates a user's claims against `options.claims`, keeping every JWT claim. */
 async function checkClaims(state, options) {
@@ -297,6 +298,25 @@ async function checkClaims(state, options) {
 		}
 	} : state;
 }
+const warnedMetadata = /* @__PURE__ */ new WeakSet();
+/** Claims first, then `user_metadata`, whose failure never invalidates the session. */
+async function checkUser(state, options) {
+	const checked = await checkClaims(state, options);
+	const schema = options.userMetadata;
+	if (checked.kind !== "user" || !schema) return checked;
+	const { profile: _untrusted, ...user } = checked;
+	let outcome = schema["~standard"].validate(checked.user.userMetadata ?? checked.claims.user_metadata ?? {});
+	if (outcome instanceof Promise) outcome = await outcome;
+	if (!outcome.issues) return {
+		...user,
+		profile: outcome.value
+	};
+	if (!warnedMetadata.has(schema)) {
+		warnedMetadata.add(schema);
+		(options.logger ?? consoleLogger).warn("user_metadata does not match sb.userMetadata(schema); session.profile is undefined", { paths: outcome.issues.map((issue) => issue.path?.map((segment) => typeof segment === "object" ? String(segment.key) : String(segment)).join(".") ?? "") });
+	}
+	return user;
+}
 async function verifyOnce(credentials, modes, options, source) {
 	const { data, error } = await verifyCredentials(credentials, {
 		auth: modes,
@@ -373,7 +393,7 @@ async function resolveAuth(request, options) {
 			kind: "invalid",
 			reason: state.reason ?? "token",
 			error: state.error
-		} : await checkClaims(state, options), cookies);
+		} : await checkUser(state, options), cookies);
 	}
 	const credentials = extractCredentials(request);
 	if (credentials.token) return resolution(await verify({

package/dist/next/index.d.ts

@@ -1,12 +1,12 @@
-import { n as AnyModels, t as AnyFunctions } from "../types-C2fslP1z.js";
+import { n as AnyModels, t as AnyFunctions } from "../types-C83v5SQz.js";
 import { p as DbError } from "../result-CTkCZ6JA.js";
-import { B as ReadSet, P as DbStats, Z as QuerySpec, l as CacheAdapter, t as BetterSupabase } from "../define-CTfWw-SS.js";
+import { B as ReadSet, P as DbStats, Z as QuerySpec, l as CacheAdapter, t as BetterSupabase } from "../define-e3zI4_4g.js";
 import { n as AmrEntry, s as Impersonator, t as Aal } from "../mfa-TVia554c.js";
-import { r as AuthState } from "../resolve-DW8h9NPm.js";
-import { d as ServerContext, f as ServerOptions, l as BetterServer, n as GuardOptions, t as AuthKind } from "../respond-PoTpy5DT.js";
-import { n as toSession, t as AuthSession } from "../view-B0ltUmTi.js";
-import { r as LiveCountSeed, t as CountRunner } from "../live-6b9i72Ux.js";
-import { n as hasEntitlement, t as EntitlementKey } from "../entitlements-BBg61DQZ.js";
+import { r as AuthState } from "../resolve-CjHILk2w.js";
+import { d as ServerContext, f as ServerOptions, l as BetterServer, n as GuardOptions, t as AuthKind } from "../respond-Dne1ARSa.js";
+import { n as toSession, t as AuthSession } from "../view-D1s0wa0T.js";
+import { r as LiveCountSeed, t as CountRunner } from "../live-DJyZMD6w.js";
+import { n as MembershipClaim, r as hasEntitlement, t as EntitlementKey } from "../entitlements-Dng-ctuT.js";
 import { NextRequest } from "next/server.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/next/collector.d.ts
@@ -38,7 +38,7 @@ export interface NextDebugOptions {
 }
 /** Response header with the URL of the request's totals on `next.debugRoute()`. */
 export declare const STATS_URL_HEADER = "x-bs-stats";
-export interface ProxyOptions<C = unknown> {
+export interface ProxyOptions<C = unknown, U = unknown> {
   /**
    * Another middleware to compose with, such as next-intl's. It runs on the
    * original request, alongside auth; its rewrite, redirect or request
@@ -46,9 +46,9 @@ export interface ProxyOptions<C = unknown> {
    */
   readonly before?: (request: NextRequest) => Response | undefined | Promise<Response | undefined>;
   /** Answer before rendering, e.g. redirect signed-out users. Refreshed cookies are kept. */
-  readonly protect?: (auth: AuthState<C>, request: NextRequest) => Response | undefined | Promise<Response | undefined>;
+  readonly protect?: (auth: AuthState<C, U>, request: NextRequest) => Response | undefined | Promise<Response | undefined>;
   /** Post-processes the final response; return a new one to replace it. */
-  readonly after?: (response: Response, auth: AuthState<C>) => Response | undefined | void | Promise<Response | undefined | void>;
+  readonly after?: (response: Response, auth: AuthState<C, U>) => Response | undefined | void | Promise<Response | undefined | void>;
   /**
    * Adds `Server-Timing: bs-proxy;dur=..., bs-verify;dur=...` (ms): the whole
    * proxy, and resolving the session (a local verify, or a refresh).
@@ -76,25 +76,25 @@ type Unwrapped<T> = T extends {
 } | {
   readonly ok: false;
 } ? D : T;
-export interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown> extends BetterServer<M, F, E, C> {
+export interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown, U = unknown> extends BetterServer<M, F, E, C, U> {
   /** `proxy.ts`: refreshes sessions for page loads and server actions. */
-  proxy(request: NextRequest, options?: ProxyOptions<C>): Promise<Response>;
+  proxy(request: NextRequest, options?: ProxyOptions<C, U>): Promise<Response>;
   /** Server Components and actions: the caller's context, memoized per request. */
-  server(): Promise<ServerContext<M, F, E, C>>;
+  server(): Promise<ServerContext<M, F, E, C, U>>;
   /**
    * The verified caller as serializable data (no token, no clients), memoized
    * per request. Wrap it in a `'use cache: private'` function with Cache
    * Components and pass the promise to `<SessionProvider>`.
    */
-  session(): Promise<AuthSession<C>>;
+  session(): Promise<AuthSession<C, U>>;
   /**
    * The context for a session and its token, without reading the request.
    * The token is verified again (memoized, no network call); a token for
    * another user than `session` gives an `invalid` context.
    */
-  serverFor(session: AuthSession<C>, options: {
+  serverFor(session: AuthSession<C, U>, options: {
     readonly token: string | null;
-  }): Promise<ServerContext<M, F, E, C>>;
+  }): Promise<ServerContext<M, F, E, C, U>>;
   /**
    * First statement of an app-authored `'use cache: private'` function: sets
    * `cacheLife` from the session's expiry (`sessionStale`), tags the entry
@@ -108,7 +108,7 @@ export interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C =
    * }
    * ```
    */
-  cached(options?: CachedOptions): Promise<CachedContext<M, F, E, C>>;
+  cached(options?: CachedOptions): Promise<CachedContext<M, F, E, C, U>>;
   /** Drops every `next.cached()` entry of a user, e.g. after a role change. */
   invalidateSession(userId: string): void;
   /**
@@ -120,13 +120,13 @@ export interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C =
    */
   liveCount<T extends Extract<keyof M, string>>(spec: QuerySpec<T, "count", number>, db?: CountRunner): Promise<LiveCountSeed<T>>;
   /** Route handler with auth, Result unwrapping and Problem Details errors. */
-  route<P = Record<string, string | string[]>>(handler: (request: NextRequest, ctx: ServerContext<M, F, E, C> & {
+  route<P = Record<string, string | string[]>>(handler: (request: NextRequest, ctx: ServerContext<M, F, E, C, U> & {
     readonly params: P;
   }) => unknown, options?: GuardOptions): (request: NextRequest, segment: {
     readonly params: Promise<P>;
   }) => Promise<Response>;
   /** Server action returning a serializable `ActionResult`. */
-  action<S extends StandardSchemaV1 | undefined, T>(options: ActionOptions<S>, fn: (input: ActionParsed<S>, ctx: ServerContext<M, F, E, C>) => Promise<T> | T): (input: ActionInput<S>) => Promise<ActionResult<Unwrapped<Awaited<T>>>>;
+  action<S extends StandardSchemaV1 | undefined, T>(options: ActionOptions<S>, fn: (input: ActionParsed<S>, ctx: ServerContext<M, F, E, C, U>) => Promise<T> | T): (input: ActionInput<S>) => Promise<ActionResult<Unwrapped<Awaited<T>>>>;
   /** Tags the current `"use cache"` scope with a table (and row) tag. */
   cacheTag(table: Extract<keyof M, string>, id?: string | number): void;
   /**
@@ -159,8 +159,8 @@ export interface CachedOptions {
     readonly expire?: number;
   };
 }
-export type CachedContext<M extends AnyModels, F extends AnyFunctions, E, C = unknown> = ServerContext<M, F, E, C> & {
-  readonly session: AuthSession<C>;
+export type CachedContext<M extends AnyModels, F extends AnyFunctions, E, C = unknown, U = unknown> = ServerContext<M, F, E, C, U> & {
+  readonly session: AuthSession<C, U>;
 };
 /** The tag `next.cached()` puts on a user's entries. */
 export declare function sessionTag(userId: string): string;
@@ -205,6 +205,6 @@ export declare function shouldRefresh(request: Request): boolean;
  * export const next = createNext(sb);
  * ```
  */
-export declare function createNext<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown>(sb: BetterSupabase<M, D, F, E, C>, options?: NextOptions): BetterNext<M, F, E, C>;
+export declare function createNext<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, U = unknown>(sb: BetterSupabase<M, D, F, E, C, U>, options?: NextOptions): BetterNext<M, F, E, C, U>;
 //#endregion
-export { type Aal, type AmrEntry, type AuthKind, type AuthSession, type DbBudget, type DbStats, type EntitlementKey, type GuardOptions, type Impersonator, hasEntitlement, toSession };
+export { type Aal, type AmrEntry, type AuthKind, type AuthSession, type DbBudget, type DbStats, type EntitlementKey, type GuardOptions, type Impersonator, type MembershipClaim, hasEntitlement, toSession };

package/dist/next/index.js

@@ -1,12 +1,13 @@
 import { n as dbError } from "../errors-Bl3rkOzo.js";
-import { n as StatsRecorder, t as EMPTY_STATS } from "../stats-3iy8u3_P.js";
-import { o as isReadSet } from "../read-set-DhX2d04c.js";
+import { n as StatsRecorder, t as EMPTY_STATS } from "../stats-C5W-rBfR.js";
+import { o as isReadSet } from "../read-set-4lI3W_gZ.js";
 import { t as validate } from "../standard-FUi3Z3-7.js";
-import { a as problemResponse } from "../problem-DPu6Fh-t.js";
-import { t as hasEntitlement } from "../entitlements-BC_khwRy.js";
-import { a as settle, c as withExtra, d as primaryCookie, i as respond, n as guard, o as createServer, s as extendServer, t as defaultExpose, u as PRIMARY_COOKIE } from "../respond-4-dhoV7x.js";
-import { r as checkAal } from "../mfa-CpogP66z.js";
-import { t as toSession } from "../view-B6F9QbG-.js";
+import { a as problemResponse } from "../problem-BTkTtRV9.js";
+import { t as isList } from "../guards-BnzDvFrz.js";
+import { t as hasEntitlement } from "../entitlements-CTEBm7IB.js";
+import { a as settle, c as withExtra, d as primaryCookie, i as respond, n as guard, o as createServer, s as extendServer, t as defaultExpose, u as PRIMARY_COOKIE } from "../respond-DMcbQwfN.js";
+import { r as checkAal } from "../mfa-CpLfJSde.js";
+import { t as toSession } from "../view-aOYizTeE.js";
 import { cache } from "react";
 import { cacheLife, cacheTag, revalidateTag, updateTag } from "next/cache.js";
 import { cookies, headers } from "next/headers.js";
@@ -411,7 +412,7 @@ function createNext(sb, options = {}) {
 			cacheTag(tagFor(table), ...id === void 0 ? [] : [tagFor(table, id)]);
 		},
 		cacheTags(target) {
-			const specs = isReadSet(target) ? Object.values(target.specs) : Array.isArray(target) ? target : [target];
+			const specs = isReadSet(target) ? Object.values(target.specs) : isList(target) ? target : [target];
 			const tags = /* @__PURE__ */ new Set();
 			for (const spec of specs) {
 				for (const table of sb.tablesOf(spec)) tags.add(tagFor(table));

package/dist/openapi/index.d.ts

@@ -1,2 +1,2 @@
-import { a as ResourceOptions, i as ResourceOperation, n as OpenApiOptions, o as createOpenApi, r as PROBLEM_SCHEMA, t as OpenApiDocument } from "../index-DRid0qIv.js";
+import { a as ResourceOptions, i as ResourceOperation, n as OpenApiOptions, o as createOpenApi, r as PROBLEM_SCHEMA, t as OpenApiDocument } from "../index-DbxFr7XG.js";
 export { OpenApiDocument, OpenApiOptions, PROBLEM_SCHEMA, ResourceOperation, ResourceOptions, createOpenApi };

package/dist/openapi/index.js

@@ -1,6 +1,6 @@
-import { n as PROBLEM_TYPE_BASE, t as PROBLEM_CONTENT_TYPE } from "../problem-DPu6Fh-t.js";
-import { t as SPEC_PINS } from "../spec-pins-t6sPaHvl.js";
-import { t as buildJsonSchema } from "../json-schema-BbwO2mZg.js";
+import { n as PROBLEM_TYPE_BASE, t as PROBLEM_CONTENT_TYPE } from "../problem-BTkTtRV9.js";
+import { t as SPEC_PINS } from "../spec-pins-C3oc-Tdp.js";
+import { t as buildJsonSchema } from "../json-schema-BpYqkCKf.js";
 //#region src/openapi/index.ts
 /** JSON Schema for RFC 9457 Problem Details as better-supabase sends them. */
 const PROBLEM_SCHEMA = {

package/dist/orpc/index.d.ts

@@ -1,8 +1,8 @@
-import { n as AnyModels, t as AnyFunctions } from "../types-C2fslP1z.js";
+import { n as AnyModels, t as AnyFunctions } from "../types-C83v5SQz.js";
 import { o as Result, p as DbError } from "../result-CTkCZ6JA.js";
-import { t as BetterSupabase } from "../define-CTfWw-SS.js";
-import { r as AuthState } from "../resolve-DW8h9NPm.js";
-import { d as ServerContext, f as ServerOptions, l as BetterServer, n as GuardOptions } from "../respond-PoTpy5DT.js";
+import { t as BetterSupabase } from "../define-e3zI4_4g.js";
+import { r as AuthState } from "../resolve-CjHILk2w.js";
+import { d as ServerContext, f as ServerOptions, l as BetterServer, n as GuardOptions } from "../respond-Dne1ARSa.js";
 import { r as ProblemDetails } from "../problem-DlgB0lYl.js";
 import { DecoratedMiddleware, ORPCError } from "@orpc/server";
 //#region src/orpc/index.d.ts

package/dist/orpc/index.js

@@ -1,6 +1,6 @@
 import { r as dbErrorOf } from "../errors-Bl3rkOzo.js";
-import { o as toProblem } from "../problem-DPu6Fh-t.js";
-import { a as settle, n as guard, o as createServer, s as extendServer, t as defaultExpose } from "../respond-4-dhoV7x.js";
+import { o as toProblem } from "../problem-BTkTtRV9.js";
+import { a as settle, n as guard, o as createServer, s as extendServer, t as defaultExpose } from "../respond-DMcbQwfN.js";
 import { COMMON_ERROR_STATUS_MAP, ORPCError, os } from "@orpc/server";
 //#region src/orpc/index.ts
 const CODES = new Map(Object.entries(COMMON_ERROR_STATUS_MAP).map(([code, status]) => [status, code]));

package/dist/otel/index.d.ts

@@ -1,6 +1,6 @@
-import { a as EventHub } from "../events-2OJsVG_d.js";
-import { f as Plugin } from "../plugin-HvGqCurB.js";
-import { t as SPEC_PINS } from "../spec-pins-CJPVghHy.js";
+import { a as EventHub } from "../events-DOt3nSO-.js";
+import { f as Plugin } from "../plugin-C4TR9J0Z.js";
+import { t as SPEC_PINS } from "../spec-pins-CqorWDnO.js";
 import { Attributes, Meter, Tracer } from "@opentelemetry/api";
 //#region src/otel/index.d.ts
 export declare const INSTRUMENTATION_NAME = "better-supabase";

package/dist/otel/index.js

@@ -1,5 +1,5 @@
 import { n as definePlugin } from "../plugin-BqR6wKMB.js";
-import { t as SPEC_PINS } from "../spec-pins-t6sPaHvl.js";
+import { t as SPEC_PINS } from "../spec-pins-C3oc-Tdp.js";
 import "../version-Cqq1m3UY.js";
 import { SpanKind, SpanStatusCode, context, metrics, propagation, trace } from "@opentelemetry/api";
 //#region src/otel/index.ts