better-supabase 0.1.0 → 0.2.0

package/dist/testing/index.js

@@ -1,12 +1,16 @@
 import { n as dbError } from "../errors-Bl3rkOzo.js";
 import { i as ok } from "../result-DWXatkd6.js";
-import { t as BetterSupabase } from "../define-QGkq04oe.js";
-import { r as resolveConfig } from "../config-D-aR2ZoN.js";
+import { t as BetterSupabase } from "../define-BXMYD9AY.js";
+import { t as isList } from "../guards-BnzDvFrz.js";
+import { r as resolveConfig } from "../config-ClDXmVtY.js";
 import { t as ENV_VARIABLES } from "../env-BEToab0I.js";
-import { n as postgresExecutor } from "../executor-Ceq60hPM.js";
+import { n as postgresExecutor } from "../executor-DeppvirK.js";
 import { o as toCloudEvents } from "../events-BuzTgn2D.js";
 import { n as isSeed, t as defineSeed } from "../seed-CzecODcJ.js";
 import { createClient } from "@supabase/supabase-js";
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
 //#region src/testing/jwt.ts
 const encoder = new TextEncoder();
 function base64url(input) {
@@ -83,6 +87,40 @@ function localAuth(secret) {
 		}
 	};
 }
+async function signEs256(key, kid, claims) {
+	const { expiresIn = 3600, ...rest } = claims;
+	const now = Math.floor(Date.now() / 1e3);
+	const payload = {
+		aud: "authenticated",
+		role: "authenticated",
+		aal: "aal1",
+		iat: now,
+		exp: now + expiresIn,
+		...rest
+	};
+	const header = base64url(JSON.stringify({
+		alg: "ES256",
+		typ: "JWT",
+		kid
+	}));
+	const body = base64url(JSON.stringify(payload));
+	const signature = await crypto.subtle.sign({
+		name: "ECDSA",
+		hash: "SHA-256"
+	}, key, encoder.encode(`${header}.${body}`));
+	return `${header}.${body}.${base64url(new Uint8Array(signature))}`;
+}
+/**
+* Signs an ES256 access token with a private JWK, the way the local stack
+* signs them once `signing_keys_path` is set. Test-only.
+*/
+async function signTestJwtWithKey(key, claims) {
+	const { kid, ...jwk } = key;
+	return signEs256(await crypto.subtle.importKey("jwk", jwk, {
+		name: "ECDSA",
+		namedCurve: "P-256"
+	}, false, ["sign"]), kid, claims);
+}
 /** An in-memory ES256 key pair that signs tokens like Supabase Auth's asymmetric keys. */
 async function createTestSigner() {
 	const pair = await crypto.subtle.generateKey({
@@ -97,32 +135,44 @@ async function createTestSigner() {
 			alg: "ES256",
 			use: "sig"
 		}] },
-		async sign(claims) {
-			const { expiresIn = 3600, ...rest } = claims;
-			const now = Math.floor(Date.now() / 1e3);
-			const payload = {
-				aud: "authenticated",
-				role: "authenticated",
-				aal: "aal1",
-				iat: now,
-				exp: now + expiresIn,
-				...rest
-			};
-			const header = base64url(JSON.stringify({
-				alg: "ES256",
-				typ: "JWT",
-				kid
-			}));
-			const body = base64url(JSON.stringify(payload));
-			const signature = await crypto.subtle.sign({
-				name: "ECDSA",
-				hash: "SHA-256"
-			}, pair.privateKey, encoder.encode(`${header}.${body}`));
-			return `${header}.${body}.${base64url(new Uint8Array(signature))}`;
-		}
+		sign: (claims) => signEs256(pair.privateKey, kid, claims)
 	};
 }
 //#endregion
+//#region src/testing/local-key.ts
+const SIGNING_KEYS_PATH = /^\s*signing_keys_path\s*=\s*"([^"]+)"/m;
+/** `supabase/config.toml`'s `signing_keys_path`, else `supabase/signing_keys.json`, in `from` or a parent. */
+async function findSigningKeys(from) {
+	for (let dir = resolve(from);; dir = dirname(dir)) {
+		const supabase = join(dir, "supabase");
+		const toml = join(supabase, "config.toml");
+		if (existsSync(toml)) {
+			const configured = SIGNING_KEYS_PATH.exec(await readFile(toml, "utf8"))?.[1];
+			const path = resolve(supabase, configured ?? "signing_keys.json");
+			if (existsSync(path)) return path;
+		}
+		if (dirname(dir) === dir) return void 0;
+	}
+}
+const isSigningKey = (value) => typeof value === "object" && value !== null && "kid" in value && typeof value.kid === "string" && "d" in value && typeof value.d === "string";
+/**
+* The key the local stack signs with: the first entry of the file
+* `better-supabase keys` wrote. `path` defaults to `$SUPABASE_SIGNING_KEYS_PATH`,
+* then `signing_keys_path` from the nearest `supabase/config.toml`.
+*/
+async function localSigningKey(path) {
+	const file = path ?? process.env["SUPABASE_SIGNING_KEYS_PATH"] ?? await findSigningKeys(process.cwd());
+	if (!file || !existsSync(file)) throw new TypeError("No local signing key. Run `better-supabase keys`, set `signing_keys_path` in supabase/config.toml and restart the stack, or pass { alg: \"HS256\" } to sign with the local JWT secret.");
+	const keys = JSON.parse(await readFile(file, "utf8"));
+	const first = Array.isArray(keys) ? keys[0] : void 0;
+	if (!isSigningKey(first)) throw new TypeError(`${file} has no private ES256 key first.`);
+	return first;
+}
+/** Signs a token with the local stack's ES256 key (see `localSigningKey`). Test-only. */
+async function signLocalJwt(claims, path) {
+	return signTestJwtWithKey(await localSigningKey(path), claims);
+}
+//#endregion
 //#region src/testing/as-user.ts
 /** The local CLI stack's default JWT secret. */
 const LOCAL_JWT_SECRET = "super-secret-jwt-token-with-at-least-32-characters-long";
@@ -133,12 +183,30 @@ function env$1(...names) {
 		if (value) return value;
 	}
 }
+const LOCAL_HOSTS = /* @__PURE__ */ new Set([
+	"localhost",
+	"127.0.0.1",
+	"[::1]",
+	"host.docker.internal"
+]);
+async function signFor(stack, url, claims) {
+	const alg = stack.alg ?? "ES256";
+	switch (alg) {
+		case "ES256": return signTestJwtWithKey(stack.signingKey ?? await localSigningKey(stack.signingKeysPath), claims);
+		case "HS256":
+			if (!LOCAL_HOSTS.has(new URL(url).hostname)) throw new TypeError(`asUser signs HS256 tokens only for a local stack, not ${url}. Use the ES256 key from \`better-supabase keys\`.`);
+			return signTestJwt(stack.jwtSecret ?? env$1("SUPABASE_JWT_SECRET") ?? "super-secret-jwt-token-with-at-least-32-characters-long", claims);
+		default: throw new TypeError(`asUser: unknown alg "${String(alg)}"`);
+	}
+}
 /**
 * A test user against the local stack: a signed token and repositories that
-* run as that user, for live RLS tests.
+* run as that user, for live RLS tests. The token is ES256-signed with the
+* key from `better-supabase keys`; pass `{ alg: 'HS256' }` for a stack that
+* still uses the shared JWT secret.
 *
 * ```ts
-* const alice = await asUser(sb, { sub: aliceId, org_id: acme });
+* const alice = await asUser(sb, { sub: aliceId, tenant_id: acme });
 * expect(await alice.db.customers.count().orThrow()).toBe(3);
 * ```
 */
@@ -146,7 +214,7 @@ async function asUser(sb, claims, stack = {}) {
 	const url = stack.url ?? env$1(...ENV_VARIABLES.url) ?? "http://127.0.0.1:54321";
 	const publishableKey = stack.publishableKey ?? env$1(...ENV_VARIABLES.publishableKey, "SUPABASE_ANON_KEY");
 	if (!publishableKey) throw new TypeError("asUser needs publishableKey or $SUPABASE_PUBLISHABLE_KEY. Run `better-supabase env` to write it to .env.local.");
-	const token = await signTestJwt(stack.jwtSecret ?? env$1("SUPABASE_JWT_SECRET") ?? "super-secret-jwt-token-with-at-least-32-characters-long", claims);
+	const token = await signFor(stack, url, claims);
 	const full = {
 		role: "authenticated",
 		...claims
@@ -313,7 +381,7 @@ function testExecutor(executor, options) {
 	const { sb } = options;
 	const table = tableKey(sb, options.table);
 	const context = { errorMappers: [] };
-	const read = () => captureOp(sb, (db) => db[table].findMany({ limit: 2 }));
+	const read = () => captureOp(sb, (db) => db[table]["findMany"]({ limit: 2 }));
 	const create = options.create;
 	return conform(`Executor "${executor.name}"`, [
 		hasName(executor),
@@ -321,7 +389,7 @@ function testExecutor(executor, options) {
 			const op = await read();
 			const result = await executor.execute(op, context);
 			expect(result.ok, `select failed: ${result.ok ? "" : result.error.message}`);
-			expect(Array.isArray(result.data.rows), "rows must be an array");
+			expect(isList(result.data.rows), "rows must be an array");
 			expect(result.data.rows.length <= 2, `limit 2 returned ${result.data.rows.length} rows`);
 			expect(result.data.count === null || typeof result.data.count === "number", "count must be a number or null");
 			if (op.kind !== "select") return;
@@ -332,7 +400,7 @@ function testExecutor(executor, options) {
 			}
 		}],
 		["counts rows", async () => {
-			const op = await captureOp(sb, (db) => db[table].count());
+			const op = await captureOp(sb, (db) => db[table]["count"]());
 			const result = await executor.execute(op, context);
 			expect(result.ok, `count failed: ${result.ok ? "" : result.error.message}`);
 			expect(typeof result.data.count === "number" && result.data.count >= 0, "count must be a number");
@@ -380,7 +448,7 @@ function testExecutor(executor, options) {
 		}],
 		executor.batch && ["batch returns one result per operation, in order", async () => {
 			const rows = await read();
-			const count = await captureOp(sb, (db) => db[table].count());
+			const count = await captureOp(sb, (db) => db[table]["count"]());
 			const missing = {
 				...rows,
 				table: {
@@ -401,15 +469,15 @@ function testExecutor(executor, options) {
 		}],
 		create && ["round-trips a write", async () => {
 			const repository = sb.connect(executor)[table];
-			const created = await repository.create(create);
+			const created = await repository["create"](create);
 			expect(created.ok, `create failed: ${JSON.stringify(created.error)}`);
 			const row = created.data;
 			for (const [key, value] of Object.entries(create)) expect(same(row[key], value), `created row has ${key} = ${JSON.stringify(row[key])}`);
 			const [primary] = sb.meta.tables[table].primaryKey;
 			expect(primary, "write checks need a table with a primary key");
-			const removed = await repository.delete(row[primary]);
+			const removed = await repository["delete"](row[primary]);
 			expect(removed.ok, `delete failed: ${JSON.stringify(removed.error)}`);
-			const again = await repository.findFirst({ where: { [primary]: row[primary] } });
+			const again = await repository["findFirst"]({ where: { [primary]: row[primary] } });
 			expect(again.ok && again.data === null, "the deleted row is still readable");
 		}]
 	]);
@@ -557,7 +625,7 @@ function testGenerator(generator, options) {
 		hasName(generator),
 		["writes files inside the project", async () => {
 			const files = await generator.generate(input());
-			expect(Array.isArray(files), "generate() must return an array");
+			expect(isList(files), "generate() must return an array");
 			for (const file of files) {
 				expect(typeof file.path === "string" && typeof file.contents === "string", "files need a path and contents");
 				expect(!file.path.startsWith("/") && !/^[A-Za-z]:/.test(file.path), `${file.path} must be relative`);
@@ -598,14 +666,14 @@ function testPlugin(plugin, options) {
 			for (const key of Object.keys(sb.meta.tables)) expect(db[key], `db.${key} is missing`);
 		}],
 		plugin.transformQuery && ["transformQuery is pure and deterministic", async () => {
-			const op = await captureOp(sb, (db) => db[table].findMany({ limit: 1 }));
+			const op = await captureOp(sb, (db) => db[table]["findMany"]({ limit: 1 }));
 			const first = plugin.transformQuery(frozenCopy(op), hook(op));
 			const second = plugin.transformQuery(frozenCopy(op), hook(op));
 			expect(typeof first === "object" && first !== null && first.kind === op.kind, "must return an operation of the same kind");
 			expect(same(first, second), "two calls with the same input differ");
 		}],
 		plugin.beforeMutation && create && ["beforeMutation is pure and deterministic", async () => {
-			const op = await captureOp(sb, (db) => db[table].create(create));
+			const op = await captureOp(sb, (db) => db[table]["create"](create));
 			if (op.kind === "select") throw new Violation("create did not produce a mutation");
 			const first = await plugin.beforeMutation(frozenCopy(op), hook(op));
 			const second = await plugin.beforeMutation(frozenCopy(op), hook(op));
@@ -613,7 +681,7 @@ function testPlugin(plugin, options) {
 			expect(same(first, second), "two calls with the same input differ");
 		}],
 		plugin.wrapExecutor && ["wrapExecutor keeps results intact", async () => {
-			const op = await captureOp(sb, (db) => db[table].findMany({ limit: 1 }));
+			const op = await captureOp(sb, (db) => db[table]["findMany"]({ limit: 1 }));
 			const data = {
 				rows: [{ marker: "conformance" }],
 				count: 1
@@ -664,8 +732,8 @@ function env(names) {
 * ```ts
 * await expectTenantIsolation(sb, {
 *   tenants: [
-*     { id: ACME, claims: { sub: alice, org_id: ACME } },
-*     { id: GLOBEX, claims: { sub: bob, org_id: GLOBEX } },
+*     { id: ACME, claims: { sub: alice, tenant_id: ACME } },
+*     { id: GLOBEX, claims: { sub: bob, tenant_id: GLOBEX } },
 *   ],
 *   tables: {
 *     tags: {
@@ -748,4 +816,4 @@ async function expectTenantIsolation(sb, options) {
 	}
 }
 //#endregion
-export { ConformanceError, LOCAL_JWT_SECRET, asUser, createTestSigner, defineSeed, expectDbBudget, expectTenantIsolation, isSeed, localAuth, signTestJwt, testAuthResolver, testCacheAdapter, testEventSink, testExecutor, testGenerator, testPlugin };
+export { ConformanceError, LOCAL_JWT_SECRET, asUser, createTestSigner, defineSeed, expectDbBudget, expectTenantIsolation, isSeed, localAuth, localSigningKey, signLocalJwt, signTestJwt, signTestJwtWithKey, testAuthResolver, testCacheAdapter, testEventSink, testExecutor, testGenerator, testPlugin };

package/dist/{types-C2fslP1z.d.ts → types-C83v5SQz.d.ts}

@@ -99,16 +99,69 @@ interface SchemaMeta {
   readonly topics?: Readonly<Record<string, string>>;
   /** Tables that broadcast change signals (`config.realtime.tables`), keyed by app key. */
   readonly realtime?: Readonly<Record<string, RealtimeTableMeta>>;
+  /** Claim names from `config.claims` that differ from the defaults. */
+  readonly claims?: Partial<ClaimsMeta>;
+}
+/** The claim names the SQL kit, codegen and runtime defaults agree on. */
+interface ClaimsMeta {
+  /** Top-level claim holding the active tenant id. Defaults to `tenant_id`. */
+  readonly tenant: string;
+  /** `scope` of the tenant entries in the `memberships` claim. Defaults to `tenant`. */
+  readonly scope: string;
+  /** Claim holding plan features per tenant (`{ [tenantId]: string[] }`). Defaults to `features`. */
+  readonly features: string;
 }
 interface RealtimeTableMeta {
   /** App column whose value scopes the broadcast topic. */
   readonly tenant?: string;
 }
+/**
+ * Storage policies that call PermDock's generated SQL helpers:
+ * `<schema>.permitted_<scope>_ids(key)` for a scope keyed by a path segment,
+ * `<schema>.permdock_has(key)` for `scope: 'global'`. Only for permissions
+ * whose grants have no row conditions beyond the scope.
+ */
+interface PermdockBucketPolicy {
+  readonly permdock: {
+    /** Downloads, signed URLs, renders and metadata reads. */
+    readonly read: string;
+    /** Listing; without it `read` covers listing too. */
+    readonly list?: string;
+    /** Uploads, updates and moves; also deletes unless `delete` is set. */
+    readonly write: string;
+    readonly delete?: string;
+  };
+  /** A PermDock scope such as `organization`, or `global`. */
+  readonly scope: string;
+  /** 1-based path segment holding the scope id. Defaults to the `{orgId}` segment. */
+  readonly segment?: number;
+  /**
+   * Schema of the helpers `permdock rls generate` writes: PermDock's
+   * `rls.schema`. Defaults to `public`.
+   */
+  readonly schema?: string;
+}
+/** A PermDock topic policy: `select` (receive) and `insert` (send) on `realtime.messages`. */
+interface PermdockTopicPolicy {
+  readonly receive: string;
+  /** Lets clients send on the topic with this permission. */
+  readonly send?: string;
+  /** A PermDock scope such as `organization`, or `global`. */
+  readonly scope: string;
+  /** 1-based `:`-separated topic segment holding the scope id. Defaults to the `{orgId}` segment. */
+  readonly segment?: number;
+  readonly schema?: string;
+}
+type BucketPolicyName = "tenant" | "owner" | "public" | "none";
 interface BucketMeta {
   readonly id: string;
   readonly public: boolean;
   readonly path: string;
-  readonly policy?: "tenant" | "owner" | "public" | "none";
+  readonly policy?: BucketPolicyName | PermdockBucketPolicy;
+  /** Claim paths for the tenant policy, when `config.claims.tenant` is not the default. */
+  readonly tenant?: {
+    readonly claim: readonly string[];
+  };
   readonly fileSizeLimit?: string;
   readonly allowedMimeTypes?: readonly string[];
 }
@@ -192,4 +245,4 @@ type IsUnion<T, U = T> = T extends unknown ? [U] extends [T] ? false : true : ne
 type PrimaryKeyValue<M extends AnyModels, T extends keyof M> = true extends IsUnion<PrimaryKeyColumn<M, T>> ? { readonly [K in PrimaryKeyColumn<M, T>]: Row<M, T>[K]; } : Row<M, T>[PrimaryKeyColumn<M, T>];
 type Simplify<T> = { [K in keyof T]: T[K]; } & {};
 //#endregion
-export { TableMeta as A, Relations as C, Simplify as D, SchemaMeta as E, UniqueKeyName as M, UniqueWhere as N, TableFlags as O, Update as P, RelationShape as S, Schema as T, ModelsOf as _, CheckConstraint as a, RealtimeTableMeta as b, DatabaseOf as c, ForeignKeyConstraint as d, FunctionMeta as f, ModelShape as g, Insert as h, Casing as i, UniqueConstraint as j, TableKey as k, Flags as l, FunctionsOf as m, AnyModels as n, Codec as o, FunctionShape as p, BucketMeta as r, ColumnMeta as s, AnyFunctions as t, FlagsShape as u, PrimaryKeyColumn as v, Row as w, RelationMeta as x, PrimaryKeyValue as y };
+export { SchemaMeta as A, PrimaryKeyValue as C, Relations as D, RelationShape as E, UniqueConstraint as F, UniqueKeyName as I, UniqueWhere as L, TableFlags as M, TableKey as N, Row as O, TableMeta as P, Update as R, PrimaryKeyColumn as S, RelationMeta as T, Insert as _, Casing as a, PermdockBucketPolicy as b, Codec as c, Flags as d, FlagsShape as f, FunctionsOf as g, FunctionShape as h, BucketPolicyName as i, Simplify as j, Schema as k, ColumnMeta as l, FunctionMeta as m, AnyModels as n, CheckConstraint as o, ForeignKeyConstraint as p, BucketMeta as r, ClaimsMeta as s, AnyFunctions as t, DatabaseOf as u, ModelShape as v, RealtimeTableMeta as w, PermdockTopicPolicy as x, ModelsOf as y };

package/dist/{view-B0ltUmTi.d.ts → view-D1s0wa0T.d.ts}

@@ -1,13 +1,13 @@
 import { p as DbError } from "./result-CTkCZ6JA.js";
 import { n as AmrEntry, s as Impersonator, t as Aal } from "./mfa-TVia554c.js";
-import { i as InvalidReason, r as AuthState } from "./resolve-DW8h9NPm.js";
+import { i as InvalidReason, r as AuthState } from "./resolve-CjHILk2w.js";
 import { JWTClaims, UserClaims } from "@supabase/server";
 //#region src/auth/view.d.ts
 /**
  * The verified caller as plain data: no token, no clients. Safe to return
  * from a `'use cache: private'` function and to pass to Client Components.
  */
-type AuthSession<C = unknown> = {
+type AuthSession<C = unknown, P = unknown> = {
   readonly kind: "user";
   readonly user: UserClaims;
   /**
@@ -17,6 +17,12 @@ type AuthSession<C = unknown> = {
   readonly claims: JWTClaims & C;
   /** Seconds since epoch, from the token's `exp`. */
   readonly expiresAt: number | null;
+  /**
+   * `user_metadata` parsed by `sb.userMetadata(schema)`, for display.
+   * Absent without a schema or when the metadata fails it. Users
+   * write this data with `auth.updateUser()`: never base access on it.
+   */
+  readonly profile?: P;
   /** `aal2` once the user verified a second factor in this session. */
   readonly aal: Aal;
   /** How the user signed in (`password`, `totp`, `sso/saml`, ...). */
@@ -38,6 +44,6 @@ type AnonReason = Extract<AuthState, {
   kind: "anon";
 }>["reason"];
 /** Drops the token from an `AuthState`, leaving only serializable fields. */
-declare function toSession<C>(auth: AuthState<C>): AuthSession<C>;
+declare function toSession<C, P>(auth: AuthState<C, P>): AuthSession<C, P>;
 //#endregion
 export { toSession as n, AuthSession as t };

package/dist/{view-B6F9QbG-.js → view-aOYizTeE.js}

@@ -1,4 +1,4 @@
-import { g as impersonatorOf, n as amrOf, t as aalOf } from "./mfa-CpogP66z.js";
+import { g as impersonatorOf, n as amrOf, t as aalOf } from "./mfa-CpLfJSde.js";
 //#region src/auth/view.ts
 /** Drops the token from an `AuthState`, leaving only serializable fields. */
 function toSession(auth) {
@@ -10,6 +10,7 @@ function toSession(auth) {
 				user: auth.user,
 				claims: auth.claims,
 				expiresAt: auth.expiresAt,
+				...auth.profile === void 0 ? {} : { profile: auth.profile },
 				aal: aalOf(auth.claims),
 				amr: amrOf(auth.claims),
 				...impersonator ? { impersonator } : {}

package/dist/webhooks/index.d.ts

@@ -1,6 +1,6 @@
-import { k as TableKey, n as AnyModels, t as AnyFunctions, w as Row } from "../types-C2fslP1z.js";
+import { N as TableKey, O as Row, n as AnyModels, t as AnyFunctions } from "../types-C83v5SQz.js";
 import { o as Result } from "../result-CTkCZ6JA.js";
-import { t as BetterSupabase } from "../define-CTfWw-SS.js";
+import { t as BetterSupabase } from "../define-e3zI4_4g.js";
 //#region src/webhooks/index.d.ts
 export interface VerifiedWebhook<T = unknown> {
   readonly id: string;
@@ -125,7 +125,7 @@ export declare function hookError(status: number, message: string): AuthHookErro
  *
  * ```ts
  * export const POST = authHook('custom_access_token', env.AUTH_HOOK_SECRET, async ({ claims, user_id }) => ({
- *   claims: { ...claims, org_id: await orgFor(user_id) },
+ *   claims: { ...claims, tenant_id: await orgFor(user_id) },
  * }));
  * ```
  */

package/dist/webhooks/index.js

@@ -1,2 +1,2 @@
-import { a as signWebhook, c as verifyWebhook, i as isDatabaseWebhook, n as databaseChange, o as timingSafeEqual, r as hookError, s as verifySharedSecret, t as authHook } from "../webhooks-DbMTJJX2.js";
+import { a as signWebhook, c as verifyWebhook, i as isDatabaseWebhook, n as databaseChange, o as timingSafeEqual, r as hookError, s as verifySharedSecret, t as authHook } from "../webhooks-DMipjhSP.js";
 export { authHook, databaseChange, hookError, isDatabaseWebhook, signWebhook, timingSafeEqual, verifySharedSecret, verifyWebhook };

package/dist/{webhooks-DbMTJJX2.js → webhooks-DMipjhSP.js}

@@ -98,7 +98,7 @@ function hookError(status, message) {
 *
 * ```ts
 * export const POST = authHook('custom_access_token', env.AUTH_HOOK_SECRET, async ({ claims, user_id }) => ({
-*   claims: { ...claims, org_id: await orgFor(user_id) },
+*   claims: { ...claims, tenant_id: await orgFor(user_id) },
 * }));
 * ```
 */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "better-supabase",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Strongly typed Supabase: generated schema, typed repositories, plugins, auth glue and framework integrations, with a CLI from day one.",
   "keywords": [
     "hono",
@@ -184,6 +184,7 @@
   },
   "devDependencies": {
     "@arethetypeswrong/cli": "0.18.5",
+    "@better-supabase/ox-config": "0.0.0",
     "@better-supabase/typescript-config": "0.0.0",
     "@effect/platform-node": "4.0.0-rc.117",
     "@opentelemetry/api": "1.9.1",
@@ -192,15 +193,17 @@
     "@supabase/supabase-js": "2.117.2",
     "@tanstack/query-core": "5.104.0",
     "@tanstack/react-query": "5.104.0",
-    "@types/node": "26.6.3",
+    "@types/node": "24.19.0",
     "@types/pg": "8.23.1",
     "@types/react": "19.3.0",
     "@types/react-dom": "19.3.0",
+    "@valibot/to-json-schema": "1.8.0",
     "@vitest/coverage-v8": "5.0.2",
     "effect": "4.0.0-rc.117",
     "hono": "4.13.10",
-    "next": "16.3.6",
+    "next": "16.3.7",
     "oxfmt": "0.71.0",
+    "oxlint": "1.86.0",
     "pg": "8.23.0",
     "publint": "0.3.24",
     "react": "19.3.0",
@@ -252,9 +255,10 @@
     "node": ">=24"
   },
   "scripts": {
-    "bench": "node src/next/next.bench.ts",
+    "bench": "node tests/next/next.bench.ts",
     "build": "tsdown",
     "check:publish": "publint && pnpm pack --out pack.tgz && attw --profile esm-only pack.tgz && rm -f pack.tgz",
+    "lint": "oxlint",
     "test": "vitest run --coverage",
     "typecheck": "tsc --noEmit --checkers 4"
   }

package/schemas/config-v1.json

@@ -148,8 +148,7 @@
               "type": "object",
               "additionalProperties": false,
               "properties": {
-                "column": { "type": "string" },
-                "claim": { "type": "string" }
+                "column": { "type": "string" }
               }
             }
           ]
@@ -169,6 +168,25 @@
         }
       }
     },
+    "claims": {
+      "description": "Claim names shared by the SQL kit, codegen and runtime defaults (PermDock's claim contract).",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "tenant": {
+          "type": "string",
+          "description": "Top-level claim holding the active tenant id. Defaults to `tenant_id`."
+        },
+        "scope": {
+          "type": "string",
+          "description": "`scope` of the tenant entries in the `memberships` claim. Defaults to `tenant`."
+        },
+        "features": {
+          "type": "string",
+          "description": "Claim holding plan features per tenant. Defaults to `features`."
+        }
+      }
+    },
     "buckets": {
       "type": "object",
       "additionalProperties": {
@@ -182,7 +200,33 @@
             "type": "string",
             "description": "Path template, e.g. `{orgId}/{customerId}/logo.webp`."
           },
-          "policy": { "enum": ["tenant", "owner", "public", "none"] },
+          "policy": {
+            "oneOf": [
+              { "enum": ["tenant", "owner", "public", "none"] },
+              {
+                "type": "object",
+                "description": "Policies that call PermDock's permitted_<scope>_ids or permdock_has helpers.",
+                "required": ["permdock", "scope"],
+                "additionalProperties": false,
+                "properties": {
+                  "permdock": {
+                    "type": "object",
+                    "required": ["read", "write"],
+                    "additionalProperties": false,
+                    "properties": {
+                      "read": { "type": "string" },
+                      "list": { "type": "string" },
+                      "write": { "type": "string" },
+                      "delete": { "type": "string" }
+                    }
+                  },
+                  "scope": { "type": "string" },
+                  "segment": { "type": "integer", "minimum": 1 },
+                  "schema": { "type": "string" }
+                }
+              }
+            ]
+          },
           "fileSizeLimit": { "type": "string" },
           "allowedMimeTypes": { "type": "array", "items": { "type": "string" } }
         }
@@ -314,7 +358,8 @@
         },
         "strict": { "type": "boolean" },
         "sources": { "type": "array", "items": { "type": "string" } },
-        "policyHelperLimit": { "type": "integer", "minimum": 1 }
+        "policyHelperLimit": { "type": "integer", "minimum": 1 },
+        "claimsLimit": { "type": "integer", "minimum": 1 }
       }
     }
   },

package/schemas/doctor-report-v1.json

@@ -64,6 +64,7 @@
               "BS404",
               "BS405",
               "BS406",
+              "BS407",
               "BS501",
               "BS502"
             ]

package/schemas/snapshot-v2.json

@@ -766,6 +766,10 @@
                       "items": {
                         "type": "string"
                       }
+                    },
+                    "source": {
+                      "type": "string",
+                      "description": "The function body (`pg_proc.prosrc`)."
                     }
                   }
                 }

package/skills/better-supabase/references/plugins.md

@@ -53,4 +53,13 @@ filled it.
 RLS still decides what a user can read and write. `tenant()` makes queries
 explicit and fills the column; it doesn't replace the policy.
 
+The tenant comes from the verified `tenant_id` claim (renamed with
+`claims.tenant` in `better-supabase.config.ts`), then `app_metadata.tenant_id`.
+Never read it from `user_metadata`, a URL or a request body. When the project
+has a `permdock.config.ts`, PermDock's hook writes that claim and the
+memberships; don't run `sql add tenant` there or call `membership_claims()`
+from a hook. `sql add entitlements` is fine: `features` is not a PermDock
+claim, but PermDock's hook doesn't write it yet, so read entitlements from the
+database on the server instead of `hasEntitlement(session, ...)`.
+
 Docs: https://bettersupabase.com/docs/plugins.md

package/skills/better-supabase-api/SKILL.md

@@ -60,8 +60,8 @@ and a replayed webhook or POST doesn't run twice.
 
 ## Testing
 
-Use `localAuth(secret)` as a resolver and `signTestJwt` / `asUser` from
-`better-supabase/testing`. See the `better-supabase-testing` skill.
+Sign tokens with `signLocalJwt` or `asUser` from `better-supabase/testing`;
+the adapter verifies them against the local JWKS. See the `better-supabase-testing` skill.
 
 Docs: https://bettersupabase.com/docs/frameworks/hono.md (and `next`,
 `orpc`, `edge`, `mcp` under `/docs/frameworks/`).

package/skills/better-supabase-testing/SKILL.md

@@ -25,6 +25,7 @@ again once you restore it.
 ## Setup
 
 - `better-supabase env` writes the URL and keys to `.env.local`; load it in the test setup.
+- `better-supabase keys` creates `supabase/signing_keys.json`. Set `signing_keys_path = "./signing_keys.json"` under `[auth]` in `supabase/config.toml`, gitignore the file and restart the stack. `asUser` signs ES256 tokens with it.
 - Typed fixtures live in `supabase/seed.ts`:
 
 ```ts
@@ -43,7 +44,7 @@ export const seed = defineSeed(sb, {
 ## RLS tests
 
 ```ts
-const alice = await asUser(sb, { sub: aliceId, org_id: ACME }, { postgres });
+const alice = await asUser(sb, { sub: aliceId, tenant_id: ACME }, { postgres });
 expect(await alice.db.customers.count().orThrow()).toBe(1);
 expect(await alice.db.customers.findById(OTHER_ORG_CUSTOMER)).toMatchObject({ ok: false });
 ```
@@ -54,8 +55,8 @@ expect(await alice.db.customers.findById(OTHER_ORG_CUSTOMER)).toMatchObject({ ok
 
 ## API tests
 
-Pass `auth: { resolvers: [localAuth(LOCAL_JWT_SECRET)] }` to the adapter and
-send `authorization: Bearer ${alice.token}`.
+Send `authorization: Bearer ${alice.token}` (or a token from `signLocalJwt`).
+The adapter verifies it against the local JWKS; no test-only resolver is needed.
 
 ## pgTAP