better-supabase 0.1.0 → 0.2.0

package/dist/{respond-PoTpy5DT.d.ts → respond-Dne1ARSa.d.ts}

@@ -1,12 +1,12 @@
-import { n as AnyModels, t as AnyFunctions } from "./types-C2fslP1z.js";
+import { n as AnyModels, t as AnyFunctions } from "./types-C83v5SQz.js";
 import { p as DbError, t as AsyncResult } from "./result-CTkCZ6JA.js";
-import { I as StatsRecorder, P as DbStats, t as BetterSupabase, y as Db } from "./define-CTfWw-SS.js";
-import { h as RequestContext } from "./plugin-HvGqCurB.js";
+import { I as StatsRecorder, P as DbStats, t as BetterSupabase, y as Db } from "./define-e3zI4_4g.js";
+import { h as RequestContext } from "./plugin-C4TR9J0Z.js";
 import { t as BetterSupabaseEnv } from "./index-Dy6kuF0P.js";
-import { r as SqlClaims, t as Postgres } from "./pool-BFeqzwQS.js";
+import { r as SqlClaims, t as Postgres } from "./pool-R2m_DkXi.js";
 import { o as ImpersonationOptions, t as Aal } from "./mfa-TVia554c.js";
-import { a as ResolveAuthOptions, r as AuthState, t as AuthResolution } from "./resolve-DW8h9NPm.js";
-import { n as Bucket } from "./index-Nxo3TJcm.js";
+import { a as ResolveAuthOptions, r as AuthState, t as AuthResolution } from "./resolve-CjHILk2w.js";
+import { n as Bucket } from "./index-DuP14VHo.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 //#region src/server/delete-account.d.ts
 interface DeleteAccountOptions {
@@ -67,9 +67,9 @@ interface ServerOptions {
     readonly pinMs?: number;
   };
 }
-interface ServerContext<M extends AnyModels, F extends AnyFunctions, E, C = unknown> {
-  readonly auth: AuthState<C>;
-  readonly resolution: AuthResolution<C>;
+interface ServerContext<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> {
+  readonly auth: AuthState<C, P>;
+  readonly resolution: AuthResolution<C, P>;
   /** supabase-js client scoped to the caller (RLS applies). */
   readonly supabase: SupabaseClient;
   /** Repositories over PostgREST as the caller. */
@@ -88,18 +88,18 @@ interface ContextOptions {
   /** Also records this context's calls into a request-wide recorder. */
   readonly stats?: StatsRecorder;
 }
-interface BetterServer<M extends AnyModels, F extends AnyFunctions, E, C = unknown> {
+interface BetterServer<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> {
   readonly env: BetterSupabaseEnv;
   resolve(request: Request, options?: {
     readonly refresh?: boolean;
-  }): Promise<AuthResolution<C>>;
+  }): Promise<AuthResolution<C, P>>;
   /**
    * Resolves auth and binds repositories to the caller. Refreshes an expired
    * cookie session only with `refresh: true`; send `ctx.resolution.apply(response)`.
    */
-  context(request: Request, options?: ContextOptions): Promise<ServerContext<M, F, E, C>>;
+  context(request: Request, options?: ContextOptions): Promise<ServerContext<M, F, E, C, P>>;
   /** The context for an auth state resolved elsewhere (the proxy, a queue message). */
-  contextFor(auth: AuthState<C>, options?: ContextOptions): ServerContext<M, F, E, C>;
+  contextFor(auth: AuthState<C, P>, options?: ContextOptions): ServerContext<M, F, E, C, P>;
   /** A stateless supabase-js client for an auth state, optionally with extra request headers. */
   supabaseFor(auth: AuthState, headers?: Readonly<Record<string, string>>): SupabaseClient;
   /** Repositories for an auth state (e.g. one resolved by the proxy). */
@@ -123,7 +123,7 @@ interface BetterServer<M extends AnyModels, F extends AnyFunctions, E, C = unkno
  * Server-side entry point for APIs, jobs, MCP servers and framework
  * adapters. Holds the secrets; `sb` stays isomorphic.
  */
-declare function createServer<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown>(sb: BetterSupabase<M, D, F, E, C>, options?: ServerOptions): BetterServer<M, F, E, C>;
+declare function createServer<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown>(sb: BetterSupabase<M, D, F, E, C, P>, options?: ServerOptions): BetterServer<M, F, E, C, P>;
 //#endregion
 //#region src/server/respond.d.ts
 type AuthKind = AuthState["kind"];

package/dist/server/index.d.ts

@@ -1,12 +1,12 @@
-import { n as AnyModels, t as AnyFunctions } from "../types-C2fslP1z.js";
-import { t as BetterSupabase, y as Db } from "../define-CTfWw-SS.js";
-import { h as RequestContext } from "../plugin-HvGqCurB.js";
+import { n as AnyModels, t as AnyFunctions } from "../types-C83v5SQz.js";
+import { t as BetterSupabase, y as Db } from "../define-e3zI4_4g.js";
+import { h as RequestContext } from "../plugin-C4TR9J0Z.js";
 import { a as checkAal, c as impersonatorOf, i as amrOf, n as AmrEntry, o as ImpersonationOptions, r as aalOf, s as Impersonator, t as Aal } from "../mfa-TVia554c.js";
-import { _ as readSession, a as ResolveAuthOptions, b as writeSession, c as clientIp, d as CookieOptions, f as CookieRecord, i as InvalidReason, l as resolveAuth, m as StoredSession, n as AuthResolver, o as ResolvedState, p as CookieWrite, r as AuthState, s as authContext, t as AuthResolution, u as AUTH_CACHE_HEADERS, y as sessionCookieName } from "../resolve-DW8h9NPm.js";
-import { _ as DeleteAccountResult, a as guard, c as settle, d as ServerContext, f as ServerOptions, g as DeleteAccountOptions, h as ReplicaState, i as Settled, l as BetterServer, m as PRIMARY_COOKIE, n as GuardOptions, o as isResult, p as createServer, r as RespondOptions, s as respond, t as AuthKind, u as ContextOptions } from "../respond-PoTpy5DT.js";
-import { a as defineResource, i as ResourceRouteOptions, n as ResourceInput, r as ResourceList, t as ResourceHandler } from "../resource-SkPTRJDD.js";
+import { _ as readSession, a as ResolveAuthOptions, b as writeSession, c as clientIp, d as CookieOptions, f as CookieRecord, i as InvalidReason, l as resolveAuth, m as StoredSession, n as AuthResolver, o as ResolvedState, p as CookieWrite, r as AuthState, s as authContext, t as AuthResolution, u as AUTH_CACHE_HEADERS, y as sessionCookieName } from "../resolve-CjHILk2w.js";
+import { _ as DeleteAccountResult, a as guard, c as settle, d as ServerContext, f as ServerOptions, g as DeleteAccountOptions, h as ReplicaState, i as Settled, l as BetterServer, m as PRIMARY_COOKIE, n as GuardOptions, o as isResult, p as createServer, r as RespondOptions, s as respond, t as AuthKind, u as ContextOptions } from "../respond-Dne1ARSa.js";
+import { a as defineResource, i as ResourceRouteOptions, n as ResourceInput, r as ResourceList, t as ResourceHandler } from "../resource-CgZa3YG_.js";
 import { a as ProblemResponseOptions, c as problemResponse, i as ProblemOptions, l as toProblem, n as PROBLEM_TYPE_BASE, o as fromProblem, r as ProblemDetails, s as isProblem, t as PROBLEM_CONTENT_TYPE } from "../problem-DlgB0lYl.js";
-import { n as RefreshOutcome, r as refreshSession } from "../index-cEeweTeM.js";
+import { n as RefreshOutcome, r as refreshSession } from "../index-CG69s15v.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { Middleware } from "@supabase/middleware";
 import { AuthMode, JWTClaims, UserClaims } from "@supabase/server";

package/dist/server/index.js

@@ -1,8 +1,8 @@
-import { a as problemResponse, i as isProblem, n as PROBLEM_TYPE_BASE, o as toProblem, r as fromProblem, t as PROBLEM_CONTENT_TYPE } from "../problem-DPu6Fh-t.js";
-import { a as settle, i as respond, n as guard, o as createServer, r as isResult, u as PRIMARY_COOKIE } from "../respond-4-dhoV7x.js";
-import { a as clientIp, f as sessionCookieName, g as impersonatorOf, i as authContext, m as refreshSession, n as amrOf, o as resolveAuth, p as writeSession, r as checkAal, s as AUTH_CACHE_HEADERS, t as aalOf, u as readSession } from "../mfa-CpogP66z.js";
-import { n as postgresExecutor } from "../executor-Ceq60hPM.js";
-import { t as defineResource } from "../resource-CYiu6Ygi.js";
+import { a as problemResponse, i as isProblem, n as PROBLEM_TYPE_BASE, o as toProblem, r as fromProblem, t as PROBLEM_CONTENT_TYPE } from "../problem-BTkTtRV9.js";
+import { a as settle, i as respond, n as guard, o as createServer, r as isResult, u as PRIMARY_COOKIE } from "../respond-DMcbQwfN.js";
+import { a as clientIp, f as sessionCookieName, g as impersonatorOf, i as authContext, m as refreshSession, n as amrOf, o as resolveAuth, p as writeSession, r as checkAal, s as AUTH_CACHE_HEADERS, t as aalOf, u as readSession } from "../mfa-CpLfJSde.js";
+import { n as postgresExecutor } from "../executor-DeppvirK.js";
+import { t as defineResource } from "../resource-BHEWmQJK.js";
 import { defineMiddleware } from "@supabase/middleware";
 //#region src/server/middleware.ts
 /** Repository context from a `@supabase/server` context. */

package/dist/{session-C3osL21k.d.ts → session-C3LxnQ0e.d.ts}

@@ -1,4 +1,4 @@
-import { t as AuthSession } from "./view-B0ltUmTi.js";
+import { t as AuthSession } from "./view-D1s0wa0T.js";
 import { ReactNode } from "react";
 //#region src/react/session.d.ts
 interface SessionProviderProps {
@@ -14,8 +14,9 @@ declare function SessionProvider(props: SessionProviderProps): ReactNode;
 /**
  * The session from the nearest `<SessionProvider>`. Suspends until the
  * promise resolves, so render it inside `<Suspense>`. `C` types the claims
- * (the output of `sb.claims(schema)`); `createHooks().useSession` infers it.
+ * (the output of `sb.claims(schema)`) and `P` the profile (the output of
+ * `sb.userMetadata(schema)`); `createHooks().useSession` infers both.
  */
-declare function useSession<C = unknown>(): AuthSession<C>;
+declare function useSession<C = unknown, P = unknown>(): AuthSession<C, P>;
 //#endregion
 export { SessionProviderProps as n, useSession as r, SessionProvider as t };

package/dist/{session-CD-3orO_.js → session-CqEwzVup.js}

@@ -8,7 +8,8 @@ function SessionProvider(props) {
 /**
 * The session from the nearest `<SessionProvider>`. Suspends until the
 * promise resolves, so render it inside `<Suspense>`. `C` types the claims
-* (the output of `sb.claims(schema)`); `createHooks().useSession` infers it.
+* (the output of `sb.claims(schema)`) and `P` the profile (the output of
+* `sb.userMetadata(schema)`); `createHooks().useSession` infers both.
 */
 function useSession() {
 	const promise = useContext(SessionContext);

package/dist/{simplify-oHiDKRVQ.js → simplify-bwJpLnaS.js}

@@ -236,8 +236,8 @@ var IrBuilder = class {
 			const keys = Object.keys(value);
 			if (keys.length > 0 && keys.every((key) => key === "is" || key === "isNot")) {
 				const items = [];
-				if (value.is !== void 0) items.push(value.is === null ? make("none", null) : make("some", value.is));
-				if (value.isNot !== void 0) items.push(value.isNot === null ? make("some", null) : not(make("some", value.isNot)));
+				if (value["is"] !== void 0) items.push(value["is"] === null ? make("none", null) : make("some", value["is"]));
+				if (value["isNot"] !== void 0) items.push(value["isNot"] === null ? make("some", null) : not(make("some", value["isNot"])));
 				return and(...items) ?? make("some", null);
 			}
 		}
@@ -341,7 +341,7 @@ var IrBuilder = class {
 	* of each group.
 	*/
 	aggregation(table, args) {
-		const groupBy = args.groupBy ?? [];
+		const groupBy = args["groupBy"] ?? [];
 		if (!Array.isArray(groupBy)) invalidRequest(`"groupBy" on "${table.key}" must be an array`, table.key);
 		const columns = groupBy.map((name) => this.selectColumn(table, String(name)));
 		const measures = [];
@@ -350,7 +350,7 @@ var IrBuilder = class {
 			if (value === void 0) continue;
 			for (const alias of this.measured(table, key, value)) measures.push(this.measure(table, fn, alias, `${key}_${alias}`));
 		}
-		const count = args._count === true;
+		const count = args["_count"] === true;
 		if (!count && measures.length === 0) invalidRequest(`aggregate on "${table.key}" needs _count, _sum, _avg, _min or _max`, table.key);
 		return {
 			columns,
@@ -461,7 +461,7 @@ var IrBuilder = class {
 					columns: [],
 					includes: []
 				},
-				where: this.where(target, args.where),
+				where: this.where(target, args["where"]),
 				orderBy: [],
 				limit: void 0,
 				required: false,
@@ -477,11 +477,11 @@ var IrBuilder = class {
 			alias: name,
 			relation,
 			target,
-			selection: this.selection(target, args.select, args.include),
-			where: this.where(target, args.where),
-			orderBy: this.orderBy(target, args.orderBy),
-			limit: typeof args.limit === "number" ? args.limit : void 0,
-			required: args.required === true
+			selection: this.selection(target, args["select"], args["include"]),
+			where: this.where(target, args["where"]),
+			orderBy: this.orderBy(target, args["orderBy"]),
+			limit: typeof args["limit"] === "number" ? args["limit"] : void 0,
+			required: args["required"] === true
 		};
 	}
 	orderBy(table, input) {
@@ -498,8 +498,8 @@ var IrBuilder = class {
 					direction: spec
 				});
 				else if (isPlainObject(spec)) {
-					const direction = spec.direction === "desc" ? "desc" : "asc";
-					const nulls = spec.nulls;
+					const direction = spec["direction"] === "desc" ? "desc" : "asc";
+					const nulls = spec["nulls"];
 					terms.push(nulls === "first" || nulls === "last" ? {
 						column,
 						direction,

package/dist/{spec-pins-t6sPaHvl.js → spec-pins-C3oc-Tdp.js}

@@ -5,7 +5,7 @@
 */
 const SPEC_PINS = {
 	otelSemconv: "1.37.0",
-	mcp: "2025-06-18",
+	mcp: "2026-07-28",
 	openapi: "3.1.1",
 	cloudevents: "1.0.2",
 	standardWebhooks: "1.0.0",

package/dist/{spec-pins-CJPVghHy.d.ts → spec-pins-CqorWDnO.d.ts}

@@ -5,7 +5,7 @@
  */
 declare const SPEC_PINS: {
   readonly otelSemconv: "1.37.0";
-  readonly mcp: "2025-06-18";
+  readonly mcp: "2026-07-28";
   readonly openapi: "3.1.1";
   readonly cloudevents: "1.0.2";
   readonly standardWebhooks: "1.0.0";

package/dist/{sql-M8l3fnS0.js → sql-DTjA1LPj.js}

@@ -1,4 +1,4 @@
-import { a as invalidRequest, n as simplifyOrFalse } from "./simplify-oHiDKRVQ.js";
+import { a as invalidRequest, n as simplifyOrFalse } from "./simplify-bwJpLnaS.js";
 //#region src/compile/sql.ts
 const MAX_PAIRS = 50;
 function quoteIdent(name) {

package/dist/ssr/index.d.ts

@@ -1,5 +1,5 @@
-import { _ as readSession, a as ResolveAuthOptions, b as writeSession, d as CookieOptions, f as CookieRecord, g as parseCookies, h as applyCookieWrites, l as resolveAuth, m as StoredSession, n as AuthResolver, p as CookieWrite, r as AuthState, s as authContext, t as AuthResolution, u as AUTH_CACHE_HEADERS, v as serializeCookie, y as sessionCookieName } from "../resolve-DW8h9NPm.js";
-import { n as toSession, t as AuthSession } from "../view-B0ltUmTi.js";
-import { n as hasEntitlement, t as EntitlementKey } from "../entitlements-BBg61DQZ.js";
-import { n as RefreshOutcome, r as refreshSession, t as RefreshOptions } from "../index-cEeweTeM.js";
-export { AUTH_CACHE_HEADERS, type AuthResolution, type AuthResolver, type AuthSession, type AuthState, type CookieOptions, type CookieRecord, type CookieWrite, type EntitlementKey, type RefreshOptions, type RefreshOutcome, type ResolveAuthOptions, type StoredSession, applyCookieWrites, authContext, hasEntitlement, parseCookies, readSession, refreshSession, resolveAuth, serializeCookie, sessionCookieName, toSession, writeSession };
+import { _ as readSession, a as ResolveAuthOptions, b as writeSession, d as CookieOptions, f as CookieRecord, g as parseCookies, h as applyCookieWrites, l as resolveAuth, m as StoredSession, n as AuthResolver, p as CookieWrite, r as AuthState, s as authContext, t as AuthResolution, u as AUTH_CACHE_HEADERS, v as serializeCookie, y as sessionCookieName } from "../resolve-CjHILk2w.js";
+import { n as toSession, t as AuthSession } from "../view-D1s0wa0T.js";
+import { n as MembershipClaim, r as hasEntitlement, t as EntitlementKey } from "../entitlements-Dng-ctuT.js";
+import { n as RefreshOutcome, r as refreshSession, t as RefreshOptions } from "../index-CG69s15v.js";
+export { AUTH_CACHE_HEADERS, type AuthResolution, type AuthResolver, type AuthSession, type AuthState, type CookieOptions, type CookieRecord, type CookieWrite, type EntitlementKey, type MembershipClaim, type RefreshOptions, type RefreshOutcome, type ResolveAuthOptions, type StoredSession, applyCookieWrites, authContext, hasEntitlement, parseCookies, readSession, refreshSession, resolveAuth, serializeCookie, sessionCookieName, toSession, writeSession };

package/dist/ssr/index.js

@@ -1,4 +1,4 @@
-import { t as hasEntitlement } from "../entitlements-BC_khwRy.js";
-import { c as applyCookieWrites, d as serializeCookie, f as sessionCookieName, i as authContext, l as parseCookies, m as refreshSession, o as resolveAuth, p as writeSession, s as AUTH_CACHE_HEADERS, u as readSession } from "../mfa-CpogP66z.js";
-import { t as toSession } from "../view-B6F9QbG-.js";
+import { t as hasEntitlement } from "../entitlements-CTEBm7IB.js";
+import { c as applyCookieWrites, d as serializeCookie, f as sessionCookieName, i as authContext, l as parseCookies, m as refreshSession, o as resolveAuth, p as writeSession, s as AUTH_CACHE_HEADERS, u as readSession } from "../mfa-CpLfJSde.js";
+import { t as toSession } from "../view-aOYizTeE.js";
 export { AUTH_CACHE_HEADERS, applyCookieWrites, authContext, hasEntitlement, parseCookies, readSession, refreshSession, resolveAuth, serializeCookie, sessionCookieName, toSession, writeSession };

package/dist/{stats-3iy8u3_P.js → stats-C5W-rBfR.js}

@@ -1,5 +1,5 @@
 import { c as mapDbError, n as dbError } from "./errors-Bl3rkOzo.js";
-import { a as invalidRequest, n as simplifyOrFalse } from "./simplify-oHiDKRVQ.js";
+import { a as invalidRequest, n as simplifyOrFalse } from "./simplify-bwJpLnaS.js";
 import { i as ok, n as err, o as toDbError } from "./result-DWXatkd6.js";
 //#region src/compile/postgrest.ts
 function scalar(value) {

package/dist/storage/index.d.ts

@@ -1,4 +1,5 @@
+import { b as PermdockBucketPolicy } from "../types-C83v5SQz.js";
 import { n as StoragePath, t as PathIn } from "../path-Cv__-OTj.js";
 import { n as TemplateValues, t as TemplateParams } from "../template-mbvlysOo.js";
-import { C as parseSize, S as fromStorageError, _ as TtlPreset, a as BucketDrift, b as UrlOptions, c as ReplaceOptions, d as StorageClient, f as StoredObject, g as TransformOptions, h as TTL, i as BucketConfig, l as ReplaceResult, m as SweepResult, n as Bucket, o as BucketPolicy, p as SweepOptions, r as BucketClient, s as ObjectTarget, t as ActualBucket, u as Reservation, v as UploadBody, x as defineBucket, y as UploadOptions } from "../index-Nxo3TJcm.js";
-export { ActualBucket, Bucket, BucketClient, BucketConfig, BucketDrift, BucketPolicy, ObjectTarget, type PathIn, ReplaceOptions, ReplaceResult, Reservation, StorageClient, type StoragePath, StoredObject, SweepOptions, SweepResult, TTL, type TemplateParams, type TemplateValues, TransformOptions, TtlPreset, UploadBody, UploadOptions, UrlOptions, defineBucket, fromStorageError, parseSize };
+import { C as parseSize, S as fromStorageError, _ as TtlPreset, a as BucketDrift, b as UrlOptions, c as ReplaceOptions, d as StorageClient, f as StoredObject, g as TransformOptions, h as TTL, i as BucketConfig, l as ReplaceResult, m as SweepResult, n as Bucket, o as BucketPolicy, p as SweepOptions, r as BucketClient, s as ObjectTarget, t as ActualBucket, u as Reservation, v as UploadBody, x as defineBucket, y as UploadOptions } from "../index-DuP14VHo.js";
+export { ActualBucket, Bucket, BucketClient, BucketConfig, BucketDrift, BucketPolicy, ObjectTarget, type PathIn, type PermdockBucketPolicy, ReplaceOptions, ReplaceResult, Reservation, StorageClient, type StoragePath, StoredObject, SweepOptions, SweepResult, TTL, type TemplateParams, type TemplateValues, TransformOptions, TtlPreset, UploadBody, UploadOptions, UrlOptions, defineBucket, fromStorageError, parseSize };

package/dist/storage/index.js

@@ -1,2 +1,2 @@
-import { i as parseSize, n as defineBucket, r as fromStorageError, t as TTL } from "../storage-BWXVUXGk.js";
+import { i as parseSize, n as defineBucket, r as fromStorageError, t as TTL } from "../storage-DuGn38fr.js";
 export { TTL, defineBucket, fromStorageError, parseSize };

package/dist/{storage-BWXVUXGk.js → storage-DuGn38fr.js}

@@ -1,7 +1,14 @@
 import { n as dbError, o as isDbError, t as DbException } from "./errors-Bl3rkOzo.js";
 import { i as ok, n as err, o as toDbError, t as AsyncResult } from "./result-DWXatkd6.js";
-import { i as sqlString, n as slug, r as sqlIdent, t as parseTemplate } from "./template-BeOGnynM.js";
+import { i as tenantClaimPaths } from "./claims-CoTobNC-.js";
+import { a as sqlString, i as sqlIdent, n as parseTemplate, r as slug, t as permdockCheck } from "./permdock-sql-CghlHPuH.js";
 //#region src/storage/index.ts
+/** Storage operations that list objects; every other `select` is a read. */
+const LIST_OPERATIONS = [
+	"object.list",
+	"object.list_v2",
+	"s3.object.list"
+];
 const TTL = {
 	minute: 60,
 	hour: 3600,
@@ -114,11 +121,12 @@ function defineBucket(config) {
 		if (index === void 0) throw new TypeError(`defineBucket: a ${kind} policy needs {${param}} as a whole path segment in "${config.path}"`);
 		return index;
 	}
+	const mode = typeof policy === "string" ? policy : "permdock";
 	const accessCheck = (() => {
-		switch (policy) {
+		switch (mode) {
 			case "tenant": {
 				const index = segmentFor(config.tenant?.param ?? "orgId", "tenant");
-				const expression = config.tenant?.sql ?? claimSql(config.tenant?.claim ?? ["org_id", "app_metadata.org_id"]);
+				const expression = config.tenant?.sql ?? claimSql(config.tenant?.claim ?? tenantClaimPaths());
 				return `split_part(name, '/', ${String(index)}) = (${expression})`;
 			}
 			case "owner": {
@@ -126,10 +134,24 @@ function defineBucket(config) {
 				return `split_part(name, '/', ${String(index)}) = (select auth.uid())::text`;
 			}
 			case "public":
-			case "none": return;
-			default: throw new TypeError(`defineBucket: unknown policy "${String(policy)}"`);
+			case "none":
+			case "permdock": return;
+			default: throw new TypeError(`defineBucket: unknown policy "${String(mode)}"`);
 		}
 	})();
+	const permdock = (() => {
+		if (typeof policy === "string") return void 0;
+		const where = `defineBucket(${config.id})`;
+		const id = policy.scope === "global" ? void 0 : `split_part(name, '/', ${String(policy.segment ?? segmentFor(config.tenant?.param ?? "orgId", "PermDock"))})`;
+		const check = (key) => permdockCheck(where, policy, key, id);
+		const keys = policy.permdock;
+		return {
+			read: check(keys.read),
+			...keys.list === void 0 ? {} : { list: check(keys.list) },
+			write: check(keys.write),
+			delete: check(keys.delete ?? keys.write)
+		};
+	})();
 	const resolve = (target) => {
 		if (typeof target !== "string") return template.build(target);
 		if (!template.match(target)) throw new DbException(dbError("invalid_input", `Path "${target}" does not match "${config.path}"`));
@@ -200,10 +222,54 @@ function defineBucket(config) {
 				inBucket,
 				void 0
 			]);
+			else if (permdock) {
+				const listing = `storage.allow_any_operation(array[${LIST_OPERATIONS.map(sqlString).join(", ")}])`;
+				if (permdock.list) policies.push([
+					"select",
+					"select",
+					"authenticated",
+					`${inBucket} and not ${listing} and ${permdock.read}`,
+					void 0
+				], [
+					"list",
+					"select",
+					"authenticated",
+					`${inBucket} and ${listing} and ${permdock.list}`,
+					void 0
+				]);
+				else policies.push([
+					"select",
+					"select",
+					"authenticated",
+					`${inBucket} and ${permdock.read}`,
+					void 0
+				]);
+				const write = `${inBucket} and ${permdock.write}`;
+				policies.push([
+					"insert",
+					"insert",
+					"authenticated",
+					void 0,
+					`${write} and ${shape}`
+				], [
+					"update",
+					"update",
+					"authenticated",
+					write,
+					`${write} and ${shape}`
+				], [
+					"delete",
+					"delete",
+					"authenticated",
+					`${inBucket} and ${permdock.delete}`,
+					void 0
+				]);
+			}
 			for (const [suffix, command, roles, using, withCheck] of policies) {
 				const policyName = sqlIdent(`bs_${name}_${suffix}`);
 				lines.push("", `drop policy if exists ${policyName} on storage.objects;`, `create policy ${policyName} on storage.objects for ${command} to ${roles}${using ? `\n  using (${using})` : ""}${withCheck ? `\n  with check (${withCheck})` : ""};`);
 			}
+			if (permdock && !permdock.list) lines.push("", `drop policy if exists ${sqlIdent(`bs_${name}_list`)} on storage.objects;`);
 			return `${lines.join("\n")}\n`;
 		},
 		toml() {
@@ -355,7 +421,7 @@ function connectBucket(bucket, client, resolve) {
 			const paths = targets.map(resolve);
 			if (paths.length === 0) return ok([]);
 			return run(() => api().createSignedUrls(paths, ttlSeconds(options?.ttl), download(options?.download))).andThen(async (data) => {
-				const failed = data.find((entry) => entry.error || !entry.signedUrl);
+				const failed = data.find((entry) => entry.error != null || !entry.signedUrl);
 				if (failed) return err(dbError("not_found", failed.error ?? `No URL for ${String(failed.path)}`, { table: bucket.id }));
 				return ok(data.map((entry) => entry.signedUrl));
 			});

package/dist/testing/index.d.ts

@@ -1,12 +1,12 @@
-import { d as GeneratorInput, u as Generator, v as ResolvedConfig } from "../index-BD6wKthp.js";
-import { E as SchemaMeta, P as Update, h as Insert, k as TableKey, n as AnyModels, t as AnyFunctions } from "../types-C2fslP1z.js";
-import { r as Executor } from "../executor-Bazhgsgq.js";
-import { P as DbStats, l as CacheAdapter, t as BetterSupabase, y as Db } from "../define-CTfWw-SS.js";
-import { h as RequestContext, n as AnyPlugin } from "../plugin-HvGqCurB.js";
-import { t as SqlClient } from "../executor-Bje4suQF.js";
-import { t as Postgres } from "../pool-BFeqzwQS.js";
-import { n as AuthResolver } from "../resolve-DW8h9NPm.js";
-import { r as EventSink, t as CloudEvent } from "../index-DQVvHzjW.js";
+import { d as Generator, f as GeneratorInput, y as ResolvedConfig } from "../index-DOsjFvMf.js";
+import { A as SchemaMeta, N as TableKey, R as Update, _ as Insert, n as AnyModels, t as AnyFunctions } from "../types-C83v5SQz.js";
+import { r as Executor } from "../executor-CGdNQ27g.js";
+import { P as DbStats, l as CacheAdapter, t as BetterSupabase, y as Db } from "../define-e3zI4_4g.js";
+import { h as RequestContext, n as AnyPlugin } from "../plugin-C4TR9J0Z.js";
+import { t as SqlClient } from "../executor-BYXQ9AGn.js";
+import { t as Postgres } from "../pool-R2m_DkXi.js";
+import { n as AuthResolver } from "../resolve-CjHILk2w.js";
+import { r as EventSink, t as CloudEvent } from "../index-Ciu5Xlml.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 //#region src/testing/jwt.d.ts
 interface TestJwtClaims {
@@ -35,9 +35,28 @@ interface TestSigner {
   };
   sign(claims: TestJwtClaims): Promise<string>;
 }
+/** A private ES256 JWK, as `better-supabase keys` writes to `supabase/signing_keys.json`. */
+interface SigningJwk extends JsonWebKey {
+  readonly kid: string;
+}
+/**
+ * Signs an ES256 access token with a private JWK, the way the local stack
+ * signs them once `signing_keys_path` is set. Test-only.
+ */
+export declare function signTestJwtWithKey(key: SigningJwk, claims: TestJwtClaims): Promise<string>;
 /** An in-memory ES256 key pair that signs tokens like Supabase Auth's asymmetric keys. */
 export declare function createTestSigner(): Promise<TestSigner>;
 //#endregion
+//#region src/testing/local-key.d.ts
+/**
+ * The key the local stack signs with: the first entry of the file
+ * `better-supabase keys` wrote. `path` defaults to `$SUPABASE_SIGNING_KEYS_PATH`,
+ * then `signing_keys_path` from the nearest `supabase/config.toml`.
+ */
+export declare function localSigningKey(path?: string): Promise<SigningJwk>;
+/** Signs a token with the local stack's ES256 key (see `localSigningKey`). Test-only. */
+export declare function signLocalJwt(claims: TestJwtClaims, path?: string): Promise<string>;
+//#endregion
 //#region src/testing/as-user.d.ts
 /** The local CLI stack's default JWT secret. */
 export declare const LOCAL_JWT_SECRET = "super-secret-jwt-token-with-at-least-32-characters-long";
@@ -46,7 +65,17 @@ interface LocalStack {
   readonly url?: string;
   /** Defaults to `$SUPABASE_PUBLISHABLE_KEY`, then `$SUPABASE_ANON_KEY`. */
   readonly publishableKey?: string;
-  /** Defaults to `$SUPABASE_JWT_SECRET`, then the CLI default. */
+  /**
+   * `ES256` (default) signs with the key `better-supabase keys` wrote, as
+   * the hosted project's asymmetric keys do. `HS256` signs with the shared
+   * JWT secret and only works against a local stack.
+   */
+  readonly alg?: "ES256" | "HS256";
+  /** The private ES256 key. Defaults to the first key in `signingKeysPath`. */
+  readonly signingKey?: SigningJwk;
+  /** Defaults to `$SUPABASE_SIGNING_KEYS_PATH`, then `signing_keys_path` in `supabase/config.toml`. */
+  readonly signingKeysPath?: string;
+  /** For `alg: 'HS256'`. Defaults to `$SUPABASE_JWT_SECRET`, then the CLI default. */
   readonly jwtSecret?: string;
   /** Service-role key for `expectTenantIsolation`; defaults to `$SUPABASE_SECRET_KEY`. */
   readonly secretKey?: string;
@@ -65,10 +94,12 @@ interface TestUser<M extends AnyModels, F extends AnyFunctions, E> {
 }
 /**
  * A test user against the local stack: a signed token and repositories that
- * run as that user, for live RLS tests.
+ * run as that user, for live RLS tests. The token is ES256-signed with the
+ * key from `better-supabase keys`; pass `{ alg: 'HS256' }` for a stack that
+ * still uses the shared JWT secret.
  *
  * ```ts
- * const alice = await asUser(sb, { sub: aliceId, org_id: acme });
+ * const alice = await asUser(sb, { sub: aliceId, tenant_id: acme });
  * expect(await alice.db.customers.count().orThrow()).toBe(3);
  * ```
  */
@@ -247,8 +278,8 @@ interface TenantIsolationOptions<M extends AnyModels> {
  * ```ts
  * await expectTenantIsolation(sb, {
  *   tenants: [
- *     { id: ACME, claims: { sub: alice, org_id: ACME } },
- *     { id: GLOBEX, claims: { sub: bob, org_id: GLOBEX } },
+ *     { id: ACME, claims: { sub: alice, tenant_id: ACME } },
+ *     { id: GLOBEX, claims: { sub: bob, tenant_id: GLOBEX } },
  *   ],
  *   tables: {
  *     tags: {
@@ -291,4 +322,4 @@ export declare function isSeed(value: unknown): value is Seed<unknown>;
  */
 export declare function defineSeed<M extends AnyModels, D, F extends AnyFunctions, E, const S extends SeedFixtures<M>>(sb: BetterSupabase<M, D, F, E>, fixtures: S & ExactSeed<M, S>): Seed<S>;
 //#endregion
-export type { BudgetPage, BudgetResponse, ConformanceCheck, ConformanceReport, DbBudgetExpectation, ExactSeed, IsolationTable, IsolationTables, IsolationTenant, LocalStack, MeasuredRender, Seed, SeedFixtures, TenantIsolationOptions, TestAuthResolverOptions, TestEventSinkOptions, TestExecutorOptions, TestGeneratorOptions, TestJwtClaims, TestPluginOptions, TestSigner, TestUser };
+export type { BudgetPage, BudgetResponse, ConformanceCheck, ConformanceReport, DbBudgetExpectation, ExactSeed, IsolationTable, IsolationTables, IsolationTenant, LocalStack, MeasuredRender, Seed, SeedFixtures, SigningJwk, TenantIsolationOptions, TestAuthResolverOptions, TestEventSinkOptions, TestExecutorOptions, TestGeneratorOptions, TestJwtClaims, TestPluginOptions, TestSigner, TestUser };