better-supabase 0.1.0 → 0.2.0

package/dist/{template-BeOGnynM.js → permdock-sql-CghlHPuH.js}

@@ -90,4 +90,28 @@ function slug(value) {
 	return value.replace(/[^A-Za-z0-9]+/g, "_").replace(/^_|_$/g, "").toLowerCase();
 }
 //#endregion
-export { sqlString as i, slug as n, sqlIdent as r, parseTemplate as t };
+//#region src/core/permdock-sql.ts
+const SCOPE = /^[a-z_][a-z0-9_]*$/;
+/** PermDock splits a key with row conditions into `key#1`, `key#2`, ...: those need its own policies. */
+const SPLIT_KEY = /#\d+$/;
+/**
+* The SQL condition for one PermDock permission key. `id` is the text
+* expression holding the scope id; it is compared as text, so a malformed
+* path never raises a cast error.
+*
+* The helpers check role and scope, not a permission's row conditions, so
+* the condition is only correct for permissions whose grants have none
+* beyond the scope. `#n` keys are refused; other row-conditioned keys can't
+* be detected here.
+*/
+function permdockCheck(where, target, key, id) {
+	if (key === "") throw new TypeError(`${where}: a PermDock permission key is empty`);
+	if (SPLIT_KEY.test(key)) throw new TypeError(`${where}: "${key}" is one part of a permission PermDock splits by row condition. Use PermDock's generated policies for it.`);
+	const schema = sqlIdent(target.schema ?? "public");
+	if (target.scope === "global") return `(select ${schema}.permdock_has(${sqlString(key)}))`;
+	if (!SCOPE.test(target.scope)) throw new TypeError(`${where}: invalid PermDock scope "${target.scope}"`);
+	if (id === void 0) throw new TypeError(`${where}: scope "${target.scope}" needs a segment`);
+	return `${id} in (select t.id::text from ${schema}.${sqlIdent(`permitted_${target.scope}_ids`)}(${sqlString(key)}) as t(id))`;
+}
+//#endregion
+export { sqlString as a, sqlIdent as i, parseTemplate as n, slug as r, permdockCheck as t };

package/dist/{plugin-HvGqCurB.d.ts → plugin-C4TR9J0Z.d.ts}

@@ -1,5 +1,5 @@
-import { A as TableMeta, E as SchemaMeta, n as AnyModels } from "./types-C2fslP1z.js";
-import { g as Operation, h as MutationOp, r as Executor } from "./executor-Bazhgsgq.js";
+import { A as SchemaMeta, P as TableMeta, n as AnyModels } from "./types-C83v5SQz.js";
+import { g as Operation, h as MutationOp, r as Executor } from "./executor-CGdNQ27g.js";
 import { v as ErrorMapper } from "./result-CTkCZ6JA.js";
 //#region src/core/plugin.d.ts
 /** Who is making the request. */

package/dist/plugins/actor/index.d.ts

@@ -1,4 +1,4 @@
-import { f as Plugin, h as RequestContext } from "../../plugin-HvGqCurB.js";
+import { f as Plugin, h as RequestContext } from "../../plugin-C4TR9J0Z.js";
 //#region src/plugins/actor/index.d.ts
 export interface ActorOptions {
   /** Custom actor id resolution. Defaults to `context.actor.id` for users and services. */

package/dist/plugins/rules/index.d.ts

@@ -1,5 +1,5 @@
-import { g as Operation } from "../../executor-Bazhgsgq.js";
-import { f as Plugin, m as RepositoryExtension } from "../../plugin-HvGqCurB.js";
+import { g as Operation } from "../../executor-CGdNQ27g.js";
+import { f as Plugin, m as RepositoryExtension } from "../../plugin-C4TR9J0Z.js";
 //#region src/plugins/rules/index.d.ts
 export type RuleLevel = "off" | "warn" | "error";
 /** A level, or a level with the rule's option: `['error', 500]`. */
@@ -20,7 +20,8 @@ export interface RuleSet {
   readonly maxIncludeDepth?: RuleSetting<number>;
   /**
    * Tenant tables queried without a tenant: neither `context.tenant` nor the
-   * given claim (default `org_id`). Service connections are exempt.
+   * given claim (default `config.claims.tenant`, `tenant_id`). Service
+   * connections are exempt.
    */
   readonly requireTenantContext?: RuleSetting<string>;
   /** A service-role connection used where `window` and `document` exist. */

package/dist/plugins/rules/index.js

@@ -1,5 +1,6 @@
 import { n as dbError, t as DbException } from "../../errors-Bl3rkOzo.js";
 import { n as definePlugin } from "../../plugin-BqR6wKMB.js";
+import { n as claimAt, r as claimsOf } from "../../claims-CoTobNC-.js";
 //#region src/plugins/rules/index.ts
 /** Catches data-exposure and correctness mistakes; everything else off. */
 function safe() {
@@ -56,14 +57,6 @@ function sensitiveColumns(selection, table) {
 function isBrowser() {
 	return typeof globalThis.window !== "undefined" && typeof globalThis.document !== "undefined";
 }
-function claimValue(context, claim) {
-	let value = context.claims;
-	for (const part of claim.split(".")) {
-		if (typeof value !== "object" || value === null) return void 0;
-		value = value[part];
-	}
-	return value;
-}
 const TEXT_TYPES = /* @__PURE__ */ new Set([
 	"text",
 	"varchar",
@@ -107,10 +100,10 @@ function checks(rules) {
 			const depth = selection ? includeDepth(selection) : 0;
 			return depth > max ? `includes nest ${depth} levels deep (maximum ${max})` : void 0;
 		},
-		requireTenantContext: (op, { context }) => {
+		requireTenantContext: (op, { context, schema }) => {
 			if (!op.table.flags.tenant || context.actor?.kind === "service") return void 0;
-			const claim = optionOf(rules.requireTenantContext, "org_id");
-			return context.tenant === void 0 && claimValue(context, claim) === void 0 ? `"${op.table.key}" is tenant-scoped but the request has no tenant (context.tenant or claim "${claim}")` : void 0;
+			const claim = optionOf(rules.requireTenantContext, claimsOf(schema).tenant);
+			return context.tenant === void 0 && claimAt(context.claims, claim) === void 0 ? `"${op.table.key}" is tenant-scoped but the request has no tenant (context.tenant or claim "${claim}")` : void 0;
 		},
 		noAdminInBrowser: (_op, { context }) => context.actor?.kind === "service" && isBrowser() ? "a service-role connection is running in a browser" : void 0,
 		noSensitiveSelect: (op, { options }) => {

package/dist/plugins/soft-delete/index.d.ts

@@ -1,6 +1,6 @@
-import { y as PrimaryKeyValue } from "../../types-C2fslP1z.js";
+import { C as PrimaryKeyValue } from "../../types-C83v5SQz.js";
 import { t as AsyncResult } from "../../result-CTkCZ6JA.js";
-import { f as Plugin, m as RepositoryExtension, o as HasFlag } from "../../plugin-HvGqCurB.js";
+import { f as Plugin, m as RepositoryExtension, o as HasFlag } from "../../plugin-C4TR9J0Z.js";
 //#region src/plugins/soft-delete/index.d.ts
 export interface SoftDeleteFindArgs {
   /** Include soft-deleted rows of the queried table. */

package/dist/plugins/tenant/index.d.ts

@@ -1,4 +1,5 @@
-import { f as Plugin, h as RequestContext, m as RepositoryExtension, o as HasFlag } from "../../plugin-HvGqCurB.js";
+import { A as SchemaMeta } from "../../types-C83v5SQz.js";
+import { f as Plugin, h as RequestContext, m as RepositoryExtension, o as HasFlag } from "../../plugin-C4TR9J0Z.js";
 //#region src/plugins/tenant/index.d.ts
 /**
  * Dotted paths to the string claims of `C` (up to three levels), e.g.
@@ -10,7 +11,9 @@ type StringPaths<T, Depth extends readonly unknown[]> = T extends object ? T ext
 export interface TenantOptions<C = unknown> {
   /**
    * JWT claim path(s) holding the tenant id when `context.tenant` is not set.
-   * Dots walk into objects. Default `['org_id', 'app_metadata.org_id']`.
+   * Dots walk into objects. Defaults to `config.claims.tenant` (`tenant_id`),
+   * then the same key in `app_metadata`. `user_metadata` is never a source:
+   * users can write it.
    */
   readonly claim?: ClaimPath<C> | readonly ClaimPath<C>[];
   /** Custom resolution, e.g. from a header validated against memberships. */
@@ -30,8 +33,11 @@ export interface TenantExtension extends RepositoryExtension {
   readonly methods: unknown;
   readonly deleteArgs: HasFlag<this["M"], this["T"], "tenant"> extends true ? TenantFindArgs : unknown;
 }
-/** The tenant for a request: `context.tenant`, then the configured claim. */
-export declare function resolveTenant<C = unknown>(context: RequestContext, options?: TenantOptions<C>): string | undefined;
+/**
+ * The tenant for a request: `context.tenant`, then the configured claim.
+ * `schema` supplies the default claim (`config.claims.tenant`).
+ */
+export declare function resolveTenant<C = unknown>(context: RequestContext, options?: TenantOptions<C>, schema?: Pick<SchemaMeta, "claims">): string | undefined;
 /**
  * Multi-tenancy for tables generated with `Flags.tenant`. Scopes reads,
  * updates and deletes to the request's tenant (nested includes and relation

package/dist/plugins/tenant/index.js

@@ -1,21 +1,23 @@
 import { n as dbError, t as DbException } from "../../errors-Bl3rkOzo.js";
 import { n as definePlugin } from "../../plugin-BqR6wKMB.js";
 import { n as scopeOperation } from "../../scope-CDHcS7dE.js";
+import { i as tenantClaimPaths, n as claimAt, r as claimsOf } from "../../claims-CoTobNC-.js";
 import { n as equals, r as forbidden, t as dbName } from "../../shared-_6-uPL7E.js";
 //#region src/plugins/tenant/index.ts
-/** The tenant for a request: `context.tenant`, then the configured claim. */
-function resolveTenant(context, options = {}) {
+/**
+* The tenant for a request: `context.tenant`, then the configured claim.
+* `schema` supplies the default claim (`config.claims.tenant`).
+*/
+function resolveTenant(context, options = {}, schema) {
 	if (options.resolve) return options.resolve(context);
 	if (typeof context.tenant === "string") return context.tenant;
 	const claim = options.claim;
-	const paths = typeof claim === "string" ? [claim] : claim ?? DEFAULT_CLAIMS;
+	const paths = typeof claim === "string" ? [claim] : claim ?? tenantClaimPaths(claimsOf(schema).tenant);
 	for (const path of paths) {
-		let value = context.claims;
-		for (const segment of path.split(".")) value = typeof value === "object" && value !== null ? value[segment] : void 0;
-		if (typeof value === "string" && value.length > 0) return value;
+		const value = claimAt(context.claims, path);
+		if (value !== void 0) return value;
 	}
 }
-const DEFAULT_CLAIMS = ["org_id", "app_metadata.org_id"];
 function tenantColumn(table) {
 	return dbName(table, table.flags.tenant);
 }
@@ -28,26 +30,26 @@ function tenantColumn(table) {
 */
 function tenant(options = {}) {
 	const onMissing = options.onMissing ?? "error";
-	const current = (table, context) => {
-		const id = resolveTenant(context, options);
+	const current = (table, context, schema) => {
+		const id = resolveTenant(context, options, schema);
 		if (id === void 0 && onMissing === "error" && tenantColumn(table)) throw new DbException(dbError("forbidden", `No tenant in the request context for "${table.key}"`));
 		return id;
 	};
 	return definePlugin({
 		name: "tenant",
-		transformQuery(op, { context, options: call }) {
+		transformQuery(op, { context, schema, options: call }) {
 			if (call["allTenants"] === true) return op;
-			const id = current(op.table, context);
+			const id = current(op.table, context, schema);
 			if (id === void 0) return op;
 			return scopeOperation(op, (table) => {
 				const column = tenantColumn(table);
 				return column ? equals(column, id) : void 0;
 			});
 		},
-		beforeMutation(op, { table, context, options: call }) {
+		beforeMutation(op, { table, context, schema, options: call }) {
 			const column = tenantColumn(table);
 			if (!column || call["allTenants"] === true) return op;
-			const id = current(table, context);
+			const id = current(table, context, schema);
 			if (id === void 0) return op;
 			switch (op.kind) {
 				case "insert": return {

package/dist/plugins/timestamps/index.d.ts

@@ -1,4 +1,4 @@
-import { f as Plugin } from "../../plugin-HvGqCurB.js";
+import { f as Plugin } from "../../plugin-C4TR9J0Z.js";
 //#region src/plugins/timestamps/index.d.ts
 /**
  * Stamps the columns generated as `Flags.timestamps`: `createdAt` on insert,

package/dist/plugins/validation/index.d.ts

@@ -1,4 +1,4 @@
-import { f as Plugin } from "../../plugin-HvGqCurB.js";
+import { f as Plugin } from "../../plugin-C4TR9J0Z.js";
 import { t as StandardSchemaV1 } from "../../standard-CyhRzctb.js";
 //#region src/plugins/validation/index.d.ts
 export interface TableValidators {

package/dist/{pool-BFeqzwQS.d.ts → pool-R2m_DkXi.d.ts}

@@ -1,4 +1,4 @@
-import { t as SqlClient } from "./executor-Bje4suQF.js";
+import { t as SqlClient } from "./executor-BYXQ9AGn.js";
 //#region src/postgres/pool.d.ts
 interface PostgresOptions {
   /** Defaults to `$SUPABASE_DB_URL`, then `$DATABASE_URL`. */

package/dist/postgres/index.d.ts

@@ -1,7 +1,7 @@
-import { g as Operation } from "../executor-Bazhgsgq.js";
-import { n as fromPgError, r as postgresExecutor, t as SqlClient } from "../executor-Bje4suQF.js";
-import { i as createPostgres, n as PostgresOptions, r as SqlClaims, t as Postgres } from "../pool-BFeqzwQS.js";
-import { t as Compiler } from "../compiler-DL18ukPe.js";
+import { g as Operation } from "../executor-CGdNQ27g.js";
+import { n as fromPgError, r as postgresExecutor, t as SqlClient } from "../executor-BYXQ9AGn.js";
+import { i as createPostgres, n as PostgresOptions, r as SqlClaims, t as Postgres } from "../pool-R2m_DkXi.js";
+import { t as Compiler } from "../compiler-CZ9nIuqy.js";
 //#region src/compile/sql.d.ts
 interface SqlQuery {
   readonly text: string;

package/dist/postgres/index.js

@@ -1,5 +1,5 @@
-import { n as quoteIdent, t as compileSql } from "../sql-M8l3fnS0.js";
-import { n as postgresExecutor, t as fromPgError } from "../executor-Ceq60hPM.js";
+import { n as quoteIdent, t as compileSql } from "../sql-DTjA1LPj.js";
+import { n as postgresExecutor, t as fromPgError } from "../executor-DeppvirK.js";
 import { Pool } from "pg";
 //#region src/postgres/pool.ts
 const ROLES = /* @__PURE__ */ new Set(["authenticated", "anon"]);

package/dist/{postgrest-Dm-vhY6R.d.ts → postgrest-cAEQ_IQN.d.ts}

@@ -1,4 +1,4 @@
-import { g as Operation } from "./executor-Bazhgsgq.js";
+import { g as Operation } from "./executor-CGdNQ27g.js";
 //#region src/compile/postgrest.d.ts
 /**
  * A compiled PostgREST request, expressed as calls on the public

package/dist/{problem-DPu6Fh-t.js → problem-BTkTtRV9.js}

@@ -43,11 +43,11 @@ function toProblem(error, options = {}) {
 	if (error.code) problem["code"] = error.code;
 	if (error.hint) problem["hint"] = error.hint;
 	if ("constraint" in error && error.constraint) problem["constraint"] = error.constraint;
-	if ("columns" in error && error.columns) problem["columns"] = error.columns;
+	if ("columns" in error) problem["columns"] = error.columns;
 	if ("column" in error && error.column) problem["column"] = error.column;
 	if ("issues" in error) problem["issues"] = error.issues;
-	if ("required" in error && error.required) problem["required"] = error.required;
-	if ("retryAfter" in error && error.retryAfter !== void 0) problem["retryAfter"] = error.retryAfter;
+	if ("required" in error) problem["required"] = error.required;
+	if ("retryAfter" in error) problem["retryAfter"] = error.retryAfter;
 	return problem;
 }
 /**
@@ -62,7 +62,7 @@ function problemResponse(error, options = {}) {
 		const params = error.code === "MISSING_CREDENTIALS" ? "" : ", error=\"invalid_token\"";
 		headers.set("www-authenticate", `Bearer realm="${realm}"${params}`);
 	}
-	if ("retryAfter" in error && error.retryAfter !== void 0 && !headers.has("retry-after")) headers.set("retry-after", String(error.retryAfter));
+	if ("retryAfter" in error && !headers.has("retry-after")) headers.set("retry-after", String(error.retryAfter));
 	return new Response(JSON.stringify(toProblem(error, options)), {
 		status: error.status,
 		headers

package/dist/query/index.d.ts

@@ -1,2 +1,2 @@
-import { a as QueryHelpers, c as TableQueries, d as queryCache, f as BetterQueryMeta, i as Queries, l as createQueries, n as InfiniteOptionsOf, o as QueryKeyOf, p as invalidateTables, r as MutationOptionsOf, s as QueryOptionsOf, t as CreateQueriesOptions, u as invalidateOnMutation } from "../index-Dup-nSe9.js";
+import { a as QueryHelpers, c as TableQueries, d as queryCache, f as BetterQueryMeta, i as Queries, l as createQueries, n as InfiniteOptionsOf, o as QueryKeyOf, p as invalidateTables, r as MutationOptionsOf, s as QueryOptionsOf, t as CreateQueriesOptions, u as invalidateOnMutation } from "../index-K-3WM2Hp.js";
 export { type BetterQueryMeta, CreateQueriesOptions, InfiniteOptionsOf, MutationOptionsOf, Queries, QueryHelpers, QueryKeyOf, QueryOptionsOf, TableQueries, createQueries, invalidateOnMutation, invalidateTables, queryCache };

package/dist/react/index.d.ts

@@ -1,7 +1,7 @@
 import { s as Impersonator } from "../mfa-TVia554c.js";
-import { t as AuthSession } from "../view-B0ltUmTi.js";
-import { r as LiveCountSeed } from "../live-6b9i72Ux.js";
-import { n as hasEntitlement, t as EntitlementKey } from "../entitlements-BBg61DQZ.js";
-import { n as SessionProviderProps, r as useSession, t as SessionProvider } from "../session-C3osL21k.js";
-import { a as BrowserLike, c as LiveCountHookOptions, d as useAuth, f as useBroadcast, h as useSupabase, i as BroadcastOptions, l as LiveQueryHookOptions, m as useLiveQuery, n as BetterSupabaseProvider, o as ClaimsOf, p as useLiveCount, r as BetterSupabaseProviderProps, s as LiveCount, t as BetterHooks, u as createHooks } from "../index-Hf8PP9sP.js";
-export { type AuthSession, BetterHooks, BetterSupabaseProvider, BetterSupabaseProviderProps, BroadcastOptions, BrowserLike, ClaimsOf, type EntitlementKey, type Impersonator, LiveCount, LiveCountHookOptions, type LiveCountSeed, LiveQueryHookOptions, SessionProvider, type SessionProviderProps, createHooks, hasEntitlement, useAuth, useBroadcast, useLiveCount, useLiveQuery, useSession, useSupabase };
+import { t as AuthSession } from "../view-D1s0wa0T.js";
+import { r as LiveCountSeed } from "../live-DJyZMD6w.js";
+import { n as MembershipClaim, r as hasEntitlement, t as EntitlementKey } from "../entitlements-Dng-ctuT.js";
+import { n as SessionProviderProps, r as useSession, t as SessionProvider } from "../session-C3LxnQ0e.js";
+import { a as BrowserLike, c as LiveCountHookOptions, d as createHooks, f as useAuth, g as useSupabase, h as useLiveQuery, i as BroadcastOptions, l as LiveQueryHookOptions, m as useLiveCount, n as BetterSupabaseProvider, o as ClaimsOf, p as useBroadcast, r as BetterSupabaseProviderProps, s as LiveCount, t as BetterHooks, u as ProfileOf } from "../index-CBDufH1M.js";
+export { type AuthSession, BetterHooks, BetterSupabaseProvider, BetterSupabaseProviderProps, BroadcastOptions, BrowserLike, ClaimsOf, type EntitlementKey, type Impersonator, LiveCount, LiveCountHookOptions, type LiveCountSeed, LiveQueryHookOptions, type MembershipClaim, ProfileOf, SessionProvider, type SessionProviderProps, createHooks, hasEntitlement, useAuth, useBroadcast, useLiveCount, useLiveQuery, useSession, useSupabase };

package/dist/react/index.js

@@ -1,5 +1,5 @@
 "use client";
-import { n as useSession, t as SessionProvider } from "../session-CD-3orO_.js";
-import { t as hasEntitlement } from "../entitlements-BC_khwRy.js";
-import { a as useLiveCount, i as useBroadcast, n as createHooks, o as useLiveQuery, r as useAuth, s as useSupabase, t as BetterSupabaseProvider } from "../react-CrOvrnIP.js";
+import { n as useSession, t as SessionProvider } from "../session-CqEwzVup.js";
+import { t as hasEntitlement } from "../entitlements-CTEBm7IB.js";
+import { a as useLiveCount, i as useBroadcast, n as createHooks, o as useLiveQuery, r as useAuth, s as useSupabase, t as BetterSupabaseProvider } from "../react-C83BdBGt.js";
 export { BetterSupabaseProvider, SessionProvider, createHooks, hasEntitlement, useAuth, useBroadcast, useLiveCount, useLiveQuery, useSession, useSupabase };

package/dist/react/server.d.ts

@@ -1,13 +1,13 @@
-import { t as AuthSession } from "../view-B0ltUmTi.js";
-import { n as SessionProviderProps, t as SessionProvider } from "../session-C3osL21k.js";
-import { a as BrowserLike, d as useAuth, f as useBroadcast, h as useSupabase, i as BroadcastOptions, l as LiveQueryHookOptions, m as useLiveQuery, n as BetterSupabaseProvider, o as ClaimsOf, r as BetterSupabaseProviderProps, t as BetterHooks } from "../index-Hf8PP9sP.js";
+import { t as AuthSession } from "../view-D1s0wa0T.js";
+import { n as SessionProviderProps, t as SessionProvider } from "../session-C3LxnQ0e.js";
+import { a as BrowserLike, f as useAuth, g as useSupabase, h as useLiveQuery, i as BroadcastOptions, l as LiveQueryHookOptions, n as BetterSupabaseProvider, o as ClaimsOf, p as useBroadcast, r as BetterSupabaseProviderProps, t as BetterHooks, u as ProfileOf } from "../index-CBDufH1M.js";
 //#region src/react/server.d.ts
 /** The `react-server` build of `useSession`: await `next.session()` instead. */
-export declare const useSession: <C = unknown>() => AuthSession<C>;
+export declare const useSession: <C = unknown, P = unknown>() => AuthSession<C, P>;
 /**
  * The `react-server` build of `createHooks`: importing a module that creates
  * hooks is safe on the server, calling a hook there throws.
  */
 export declare function createHooks<B extends BrowserLike>(): BetterHooks<B>;
 //#endregion
-export { type AuthSession, type BetterHooks, BetterSupabaseProvider, type BetterSupabaseProviderProps, type BroadcastOptions, type BrowserLike, type ClaimsOf, type LiveQueryHookOptions, SessionProvider, type SessionProviderProps, useAuth, useBroadcast, useLiveQuery, useSupabase };
+export { type AuthSession, type BetterHooks, BetterSupabaseProvider, type BetterSupabaseProviderProps, type BroadcastOptions, type BrowserLike, type ClaimsOf, type LiveQueryHookOptions, type ProfileOf, SessionProvider, type SessionProviderProps, useAuth, useBroadcast, useLiveQuery, useSupabase };

package/dist/react/server.js

@@ -1,4 +1,4 @@
-import { i as useBroadcast, o as useLiveQuery, r as useAuth, s as useSupabase, t as BetterSupabaseProvider } from "../react-CrOvrnIP.js";
+import { i as useBroadcast, o as useLiveQuery, r as useAuth, s as useSupabase, t as BetterSupabaseProvider } from "../react-C83BdBGt.js";
 import { SessionProvider } from "./session.js";
 //#region src/react/server.ts
 function clientOnly(name) {

package/dist/react/session.d.ts

@@ -1,2 +1,2 @@
-import { n as SessionProviderProps, r as useSession, t as SessionProvider } from "../session-C3osL21k.js";
+import { n as SessionProviderProps, r as useSession, t as SessionProvider } from "../session-C3LxnQ0e.js";
 export { SessionProvider, SessionProviderProps, useSession };

package/dist/react/session.js

@@ -1,3 +1,3 @@
 "use client";
-import { n as useSession, t as SessionProvider } from "../session-CD-3orO_.js";
+import { n as useSession, t as SessionProvider } from "../session-CqEwzVup.js";
 export { SessionProvider, useSession };

package/dist/{react-CrOvrnIP.js → react-C83BdBGt.js}

@@ -1,6 +1,7 @@
+import { i as tenantClaimPaths, n as claimAt, r as claimsOf } from "./claims-CoTobNC-.js";
 import { t as invalidateTables } from "./invalidate-DbxuL2jL.js";
 import { n as liveQuery, t as liveCount } from "./live-D8rV1Ldw.js";
-import { n as useSession } from "./session-CD-3orO_.js";
+import { n as useSession } from "./session-CqEwzVup.js";
 import { createContext, createElement, useContext, useEffect, useMemo, useRef, useState, useSyncExternalStore } from "react";
 //#region src/react/index.ts
 const BrowserContext = createContext(null);
@@ -124,12 +125,12 @@ function useBroadcast(topic, values, handlers, options) {
 	]);
 	return status;
 }
-function claimedTenant(auth) {
+function claimedTenant(auth, meta) {
 	if (auth.status !== "signed-in") return void 0;
-	const top = auth.claims["org_id"];
-	if (typeof top === "string") return top;
-	const app = auth.claims["app_metadata"];
-	return typeof app?.["org_id"] === "string" ? app["org_id"] : void 0;
+	for (const path of tenantClaimPaths(claimsOf(meta).tenant)) {
+		const value = claimAt(auth.claims, path);
+		if (value !== void 0) return value;
+	}
 }
 /**
 * Keeps a query fresh: invalidates every cached query that read a table the
@@ -148,7 +149,7 @@ function useLiveQuery(spec, options = {}) {
 	const [status, setStatus] = useState("closed");
 	if (spec && !queryClient) throw new Error("better-supabase: useLiveQuery needs <BetterSupabaseProvider queryClient={...}>");
 	const key = spec ? JSON.stringify(spec) : null;
-	const tenant = options.tenant ?? claimedTenant(auth);
+	const tenant = options.tenant ?? claimedTenant(auth, browser.sb.meta);
 	const userId = auth.user?.id ?? null;
 	const debounceMs = options.debounceMs;
 	useEffect(() => {
@@ -196,7 +197,7 @@ function useLiveCount(source, options = {}) {
 	});
 	const [status, setStatus] = useState("closed");
 	const key = spec ? JSON.stringify(spec) : null;
-	const tenant = options.tenant ?? claimedTenant(auth);
+	const tenant = options.tenant ?? claimedTenant(auth, browser.sb.meta);
 	const userId = auth.user?.id ?? null;
 	const debounceMs = options.debounceMs;
 	const hasInitial = initial !== void 0;

package/dist/{read-set-DhX2d04c.js → read-set-4lI3W_gZ.js}

@@ -1,4 +1,4 @@
-import { r as IrBuilder, u as tableMeta } from "./simplify-oHiDKRVQ.js";
+import { r as IrBuilder, u as tableMeta } from "./simplify-bwJpLnaS.js";
 import { n as touchedTables } from "./tables-rZxRxNPW.js";
 //#region src/core/spec.ts
 const READ_METHODS = [

package/dist/realtime/index.d.ts

@@ -1,3 +1,4 @@
+import { x as PermdockTopicPolicy } from "../types-C83v5SQz.js";
 import { n as TemplateValues, t as TemplateParams } from "../template-mbvlysOo.js";
-import { C as defineTopic, S as TriggerOptions, _ as TopicEvent, a as LiveSource, b as TopicOptions, c as liveQuery, d as RealtimeClient, f as RowChange, g as Topic, h as SubscriptionStatus, i as LiveQueryOptions, l as liveTopic, m as Subscription, n as LiveCountOptions, o as LiveSubscription, p as SubscribeOptions, r as LiveCountSeed, s as liveCount, t as CountRunner, u as EventSchemas, v as TopicHandlers, w as rowChange, x as TopicPayload, y as TopicMessage } from "../live-6b9i72Ux.js";
-export { type CountRunner, EventSchemas, type LiveCountOptions, type LiveCountSeed, type LiveQueryOptions, type LiveSource, type LiveSubscription, RealtimeClient, RowChange, SubscribeOptions, Subscription, SubscriptionStatus, type TemplateParams, type TemplateValues, Topic, TopicEvent, TopicHandlers, TopicMessage, TopicOptions, TopicPayload, TriggerOptions, defineTopic, liveCount, liveQuery, liveTopic, rowChange };
+import { C as defineTopic, S as TriggerOptions, _ as TopicEvent, a as LiveSource, b as TopicOptions, c as liveQuery, d as RealtimeClient, f as RowChange, g as Topic, h as SubscriptionStatus, i as LiveQueryOptions, l as liveTopic, m as Subscription, n as LiveCountOptions, o as LiveSubscription, p as SubscribeOptions, r as LiveCountSeed, s as liveCount, t as CountRunner, u as EventSchemas, v as TopicHandlers, w as rowChange, x as TopicPayload, y as TopicMessage } from "../live-DJyZMD6w.js";
+export { type CountRunner, EventSchemas, type LiveCountOptions, type LiveCountSeed, type LiveQueryOptions, type LiveSource, type LiveSubscription, type PermdockTopicPolicy, RealtimeClient, RowChange, SubscribeOptions, Subscription, SubscriptionStatus, type TemplateParams, type TemplateValues, Topic, TopicEvent, TopicHandlers, TopicMessage, TopicOptions, TopicPayload, TriggerOptions, defineTopic, liveCount, liveQuery, liveTopic, rowChange };

package/dist/realtime/index.js

@@ -1,8 +1,9 @@
 import { n as dbError } from "../errors-Bl3rkOzo.js";
 import { i as ok, n as err, t as AsyncResult } from "../result-DWXatkd6.js";
+import { i as tenantClaimPaths } from "../claims-CoTobNC-.js";
 import { n as liveQuery, r as liveTopic, t as liveCount } from "../live-D8rV1Ldw.js";
 import { s as toApp } from "../shared-_6-uPL7E.js";
-import { i as sqlString, n as slug, r as sqlIdent, t as parseTemplate } from "../template-BeOGnynM.js";
+import { a as sqlString, i as sqlIdent, n as parseTemplate, r as slug, t as permdockCheck } from "../permdock-sql-CghlHPuH.js";
 import { REALTIME_SUBSCRIBE_STATES } from "@supabase/supabase-js";
 //#region src/realtime/index.ts
 const VALUE = /^[\w.@+=-]+$/;
@@ -64,10 +65,21 @@ function defineTopic(template, options = {}) {
 		return index;
 	};
 	const checks = [];
+	const permdock = options.permdock;
 	const tenantParam = options.tenant === false ? void 0 : options.tenant?.param ?? "orgId";
-	if (tenantParam && (options.tenant || parsed.params.includes(tenantParam))) {
-		const tenant = options.tenant || {};
-		const expression = tenant.sql ?? claimSql(tenant.claim ?? ["org_id", "app_metadata.org_id"]);
+	const permdockChecks = (() => {
+		if (!permdock) return void 0;
+		const where = `defineTopic(${template})`;
+		const id = permdock.scope === "global" ? void 0 : `split_part((select realtime.topic()), ':', ${String(permdock.segment ?? segment(tenantParam ?? "orgId", "PermDock"))})`;
+		const receive = permdockCheck(where, permdock, permdock.receive, id);
+		return {
+			receive,
+			send: permdock.send === void 0 ? receive : permdockCheck(where, permdock, permdock.send, id)
+		};
+	})();
+	if (!permdock && tenantParam && (options.tenant || parsed.params.includes(tenantParam))) {
+		const tenant = options.tenant === false ? {} : options.tenant ?? {};
+		const expression = tenant.sql ?? claimSql(tenant.claim ?? tenantClaimPaths());
 		checks.push(`split_part((select realtime.topic()), ':', ${String(segment(tenantParam, "tenant"))}) = (${expression})`);
 	}
 	const ownerParam = options.owner === false ? void 0 : options.owner?.param ?? "userId";
@@ -82,25 +94,28 @@ function defineTopic(template, options = {}) {
 		match: (topic) => parsed.match(topic),
 		sql() {
 			const extensions = options.presence ? "('broadcast', 'presence')" : "('broadcast')";
-			const condition = [
+			const condition = (extra) => [
 				`(select realtime.topic()) ~ ${sqlString(parsed.sqlPattern)}`,
 				`realtime.messages.extension in ${extensions}`,
-				...checks
+				...checks,
+				...extra === void 0 ? [] : [extra]
 			].join("\n    and ");
 			const lines = [`-- better-supabase: topic ${template}`];
 			const policies = [[
 				"receive",
 				"select",
-				"using"
+				"using",
+				condition(permdockChecks?.receive)
 			]];
-			if (options.send || options.presence) policies.push([
+			if (options.send || options.presence || permdock?.send !== void 0) policies.push([
 				"send",
 				"insert",
-				"with check"
+				"with check",
+				condition(permdockChecks?.send)
 			]);
-			for (const [suffix, command, clause] of policies) {
+			for (const [suffix, command, clause, check] of policies) {
 				const policy = sqlIdent(`bs_topic_${name}_${suffix}`);
-				lines.push(`drop policy if exists ${policy} on realtime.messages;`, `create policy ${policy} on realtime.messages for ${command} to authenticated\n  ${clause} (\n    ${condition}\n  );`);
+				lines.push(`drop policy if exists ${policy} on realtime.messages;`, `create policy ${policy} on realtime.messages for ${command} to authenticated\n  ${clause} (\n    ${check}\n  );`);
 			}
 			return `${lines.join("\n")}\n`;
 		},

package/dist/{resolve-DW8h9NPm.d.ts → resolve-CjHILk2w.d.ts}

@@ -1,6 +1,6 @@
 import { p as DbError } from "./result-CTkCZ6JA.js";
-import { l as RefreshEvent } from "./events-2OJsVG_d.js";
-import { h as RequestContext } from "./plugin-HvGqCurB.js";
+import { f as Logger, l as RefreshEvent } from "./events-DOt3nSO-.js";
+import { h as RequestContext } from "./plugin-C4TR9J0Z.js";
 import { t as StandardSchemaV1 } from "./standard-CyhRzctb.js";
 import { t as BetterSupabaseEnv } from "./index-Dy6kuF0P.js";
 import { CookieOptions } from "@supabase/ssr";
@@ -47,9 +47,10 @@ declare function applyCookieWrites(cookies: readonly CookieRecord[], writes: rea
 //#region src/auth/resolve.d.ts
 /**
  * Who is calling. `C` is the claims type from `sb.claims(schema)`; the
- * verified payload keeps every JWT claim and adds the schema's output.
+ * verified payload keeps every JWT claim and adds the schema's output. `P`
+ * is the `user_metadata` type from `sb.userMetadata(schema)`.
  */
-type AuthState<C = unknown> = {
+type AuthState<C = unknown, P = unknown> = {
   readonly kind: "user";
   readonly token: string;
   readonly claims: JWTClaims & C;
@@ -57,6 +58,12 @@ type AuthState<C = unknown> = {
   readonly source: "bearer" | "cookie" | (string & {});
   /** Seconds since epoch, from the token's `exp`. */
   readonly expiresAt: number | null;
+  /**
+   * `user_metadata` parsed by `sb.userMetadata(schema)`; `undefined`
+   * without a schema or when the metadata fails it. Users can write this
+   * data themselves: use it for display, never for access.
+   */
+  readonly profile?: P;
 } | {
   readonly kind: "service";
   readonly keyName: string;
@@ -114,6 +121,14 @@ interface ResolveAuthOptions {
    * resolves to `{ kind: 'invalid', reason: 'claims' }`.
    */
   readonly claims?: StandardSchemaV1;
+  /**
+   * Parses `user_metadata` into `profile` (`sb.userMetadata(schema)` sets
+   * it). A failure leaves `profile` undefined and warns once; the session
+   * stays valid.
+   */
+  readonly userMetadata?: StandardSchemaV1;
+  /** Receives the `userMetadata` warning. Defaults to `console`. */
+  readonly logger?: Logger;
   readonly resolvers?: readonly AuthResolver[];
   /**
    * The caller's IP, sent to Auth as `Sb-Forwarded-For` on refreshes so its
@@ -127,8 +142,8 @@ interface ResolveAuthOptions {
   readonly fetch?: typeof fetch;
   readonly now?: () => number;
 }
-interface AuthResolution<C = unknown> {
-  readonly auth: AuthState<C>;
+interface AuthResolution<C = unknown, P = unknown> {
+  readonly auth: AuthState<C, P>;
   /** Cookie writes for the response. Empty unless the session was refreshed or cleared. */
   readonly cookies: readonly CookieWrite[];
   /** No-store headers, set whenever `cookies` is not empty. */

package/dist/{resource-CYiu6Ygi.js → resource-BHEWmQJK.js}

@@ -1,7 +1,7 @@
 import { n as dbError } from "./errors-Bl3rkOzo.js";
 import { i as ok, n as err } from "./result-DWXatkd6.js";
 import { t as validate } from "./standard-FUi3Z3-7.js";
-import { i as respond } from "./respond-4-dhoV7x.js";
+import { i as respond } from "./respond-DMcbQwfN.js";
 //#region src/server/resource.ts
 const INTEGER = /* @__PURE__ */ new Set([
 	"int2",

package/dist/{resource-SkPTRJDD.d.ts → resource-CgZa3YG_.d.ts}

@@ -1,8 +1,8 @@
-import { A as TableMeta, P as Update, h as Insert, k as TableKey, n as AnyModels, t as AnyFunctions } from "./types-C2fslP1z.js";
+import { N as TableKey, P as TableMeta, R as Update, _ as Insert, n as AnyModels, t as AnyFunctions } from "./types-C83v5SQz.js";
 import { b as ValidationIssue, o as Result } from "./result-CTkCZ6JA.js";
-import { t as BetterSupabase, xt as SelectArg } from "./define-CTfWw-SS.js";
-import { r as RespondOptions } from "./respond-PoTpy5DT.js";
-import { i as ResourceOperation } from "./index-DRid0qIv.js";
+import { t as BetterSupabase, xt as SelectArg } from "./define-e3zI4_4g.js";
+import { r as RespondOptions } from "./respond-Dne1ARSa.js";
+import { i as ResourceOperation } from "./index-DbxFr7XG.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/server/resource.d.ts
 /** What a resource needs from `defineListQuery`. */

package/dist/{respond-4-dhoV7x.js → respond-DMcbQwfN.js}

@@ -1,10 +1,10 @@
 import { n as dbError, o as isDbError, r as dbErrorOf } from "./errors-Bl3rkOzo.js";
 import { i as ok, n as err, o as toDbError, t as AsyncResult } from "./result-DWXatkd6.js";
-import { a as postgrestExecutor, n as StatsRecorder } from "./stats-3iy8u3_P.js";
-import { a as problemResponse } from "./problem-DPu6Fh-t.js";
+import { a as postgrestExecutor, n as StatsRecorder } from "./stats-C5W-rBfR.js";
+import { a as problemResponse } from "./problem-BTkTtRV9.js";
 import { i as loadEnv } from "./env-BEToab0I.js";
-import { h as actClaim, i as authContext, o as resolveAuth, r as checkAal } from "./mfa-CpogP66z.js";
-import { n as postgresExecutor } from "./executor-Ceq60hPM.js";
+import { h as actClaim, i as authContext, o as resolveAuth, r as checkAal } from "./mfa-CpLfJSde.js";
+import { n as postgresExecutor } from "./executor-DeppvirK.js";
 import { createClient } from "@supabase/supabase-js";
 //#region src/server/replicas.ts
 /** Cookie holding the epoch ms until which reads stay on the primary. */
@@ -257,9 +257,12 @@ function createServer(sb, options = {}) {
 	};
 	const resolve = async (request, resolveOptions = {}) => {
 		const claims = options.auth?.claims ?? sb.claimsSchema;
+		const userMetadata = sb.userMetadataSchema;
 		const resolution = await resolveAuth(request, {
+			logger: sb.events.logger,
 			...options.auth,
 			...claims ? { claims } : {},
+			...userMetadata ? { userMetadata } : {},
 			env: env(),
 			...resolveOptions.refresh !== void 0 ? { refresh: resolveOptions.refresh } : {},
 			onRefresh: (event) => {