better-supabase 0.1.0 → 0.3.0

package/schemas/config-v1.json

@@ -67,7 +67,7 @@
       "type": "object",
       "additionalProperties": false,
       "properties": {
-        "timestamptz": { "enum": ["string", "date"], "default": "string" },
+        "timestamptz": { "enum": ["string", "instant"], "default": "string" },
         "int8": { "enum": ["number", "string", "bigint"], "default": "number" },
         "numeric": { "enum": ["number", "string"], "default": "number" }
       }
@@ -148,8 +148,7 @@
               "type": "object",
               "additionalProperties": false,
               "properties": {
-                "column": { "type": "string" },
-                "claim": { "type": "string" }
+                "column": { "type": "string" }
               }
             }
           ]
@@ -169,6 +168,25 @@
         }
       }
     },
+    "claims": {
+      "description": "Claim names shared by the SQL kit, codegen and runtime defaults (PermDock's claim contract).",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "tenant": {
+          "type": "string",
+          "description": "Top-level claim holding the active tenant id. Defaults to `tenant_id`."
+        },
+        "scope": {
+          "type": "string",
+          "description": "`scope` of the tenant entries in the `memberships` claim. Defaults to `tenant`."
+        },
+        "features": {
+          "type": "string",
+          "description": "Claim holding plan features per tenant. Defaults to `features`."
+        }
+      }
+    },
     "buckets": {
       "type": "object",
       "additionalProperties": {
@@ -182,7 +200,33 @@
             "type": "string",
             "description": "Path template, e.g. `{orgId}/{customerId}/logo.webp`."
           },
-          "policy": { "enum": ["tenant", "owner", "public", "none"] },
+          "policy": {
+            "oneOf": [
+              { "enum": ["tenant", "owner", "public", "none"] },
+              {
+                "type": "object",
+                "description": "Policies that call PermDock's permitted_<scope>_ids or permdock_has helpers.",
+                "required": ["permdock", "scope"],
+                "additionalProperties": false,
+                "properties": {
+                  "permdock": {
+                    "type": "object",
+                    "required": ["read", "write"],
+                    "additionalProperties": false,
+                    "properties": {
+                      "read": { "type": "string" },
+                      "list": { "type": "string" },
+                      "write": { "type": "string" },
+                      "delete": { "type": "string" }
+                    }
+                  },
+                  "scope": { "type": "string" },
+                  "segment": { "type": "integer", "minimum": 1 },
+                  "schema": { "type": "string" }
+                }
+              }
+            ]
+          },
           "fileSizeLimit": { "type": "string" },
           "allowedMimeTypes": { "type": "array", "items": { "type": "string" } }
         }
@@ -239,6 +283,36 @@
           "description": "The tenant id column of that table.",
           "type": "string",
           "default": "id"
+        },
+        "permdock": {
+          "description": "With a PermDock manifest, read PermDock's memberships for this scope instead of better_supabase.memberships; false keeps the kit's table.",
+          "oneOf": [
+            { "const": false },
+            {
+              "type": "object",
+              "additionalProperties": false,
+              "properties": {
+                "scope": { "type": "string", "default": "organization" }
+              }
+            }
+          ]
+        }
+      }
+    },
+    "permdock": {
+      "description": "Where PermDock's JSON outputs are.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "manifest": {
+          "description": "What `permdock supabase inspect --out` writes.",
+          "type": "string",
+          "default": "permdock.manifest.json"
+        },
+        "catalog": {
+          "description": "What `permdock catalog` writes.",
+          "type": "string",
+          "default": "permissions.catalog.json"
         }
       }
     },
@@ -314,7 +388,8 @@
         },
         "strict": { "type": "boolean" },
         "sources": { "type": "array", "items": { "type": "string" } },
-        "policyHelperLimit": { "type": "integer", "minimum": 1 }
+        "policyHelperLimit": { "type": "integer", "minimum": 1 },
+        "claimsLimit": { "type": "integer", "minimum": 1 }
       }
     }
   },

package/schemas/doctor-report-v1.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://unpkg.com/better-supabase/schemas/doctor-report-v1.json",
   "title": "better-supabase doctor report",
-  "description": "Output of `better-supabase doctor --format json`.",
+  "description": "Output of `better-supabase doctor --json`.",
   "type": "object",
   "additionalProperties": false,
   "required": ["$schema", "version", "tool", "summary", "findings"],
@@ -42,6 +42,12 @@
               "BS106",
               "BS107",
               "BS108",
+              "BS109",
+              "BS110",
+              "BS111",
+              "BS112",
+              "BS113",
+              "BS114",
               "BS200",
               "BS204",
               "BS205",
@@ -52,6 +58,15 @@
               "BS210",
               "BS211",
               "BS212",
+              "BS213",
+              "BS214",
+              "BS215",
+              "BS216",
+              "BS217",
+              "BS218",
+              "BS219",
+              "BS220",
+              "BS221",
               "BS301",
               "BS302",
               "BS303",
@@ -64,6 +79,8 @@
               "BS404",
               "BS405",
               "BS406",
+              "BS407",
+              "BS408",
               "BS501",
               "BS502"
             ]

package/schemas/snapshot-v2.json

@@ -690,6 +690,12 @@
                 "additionalProperties": {
                   "type": "string"
                 }
+              },
+              "execute": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
               }
             }
           }
@@ -766,6 +772,10 @@
                       "items": {
                         "type": "string"
                       }
+                    },
+                    "source": {
+                      "type": "string",
+                      "description": "The function body (`pg_proc.prosrc`)."
                     }
                   }
                 }
@@ -897,6 +907,12 @@
               },
               "partial": {
                 "type": "boolean"
+              },
+              "method": {
+                "type": "string"
+              },
+              "predicate": {
+                "type": ["string", "null"]
               }
             }
           }
@@ -992,6 +1008,29 @@
             }
           }
         },
+        "columnGrants": {
+          "description": "Column-level insert and update grants to anon and authenticated. Absent in snapshots taken before they were introspected.",
+          "type": "array",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["column", "role", "privileges"],
+            "properties": {
+              "column": {
+                "type": "string"
+              },
+              "role": {
+                "type": "string"
+              },
+              "privileges": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              }
+            }
+          }
+        },
         "large": {
           "description": "Postgres estimates at least 10,000 rows; the unbounded-read lint rule reads it.",
           "const": true

package/skills/better-supabase/SKILL.md

@@ -11,13 +11,22 @@ The data layer is `sb = defineSupabase(schema)` in `src/lib/supabase.ts`.
 
 ## Workflow: change the schema
 
-1. Write the migration (`supabase/schemas/*.sql` plus `supabase db diff`, or
-   `supabase migration new`).
-2. Apply it with `supabase db reset` (or `supabase migration up`).
-3. Run `pnpm better-supabase gen`, then fix the type errors it surfaces.
-4. Run `pnpm better-supabase doctor` and fix every error it reports (RLS off,
-   missing policies, unindexed foreign keys, drift).
-5. Commit the generated files. CI runs `better-supabase gen --check`.
+1. Write the migration: edit `supabase/schemas/*.sql`, then run
+   `supabase db schema declarative sync -f <name>` (pg-delta;
+   `supabase db diff -f <name>` when `config.toml` has no
+   `[experimental.pgdelta] enabled = true`), or `supabase migration new` for
+   data and role settings.
+2. For a new table in an exposed schema, in the same file: `enable row level
+security`, a policy per role and command the app uses, and an index on
+   every column a policy filters by. List the table in `expose` in
+   `better-supabase.config.ts` and run `pnpm better-supabase sql add grants`:
+   new tables get no Data API grants on their own.
+3. Apply it with `supabase db reset` (or `supabase migration up`).
+4. Run `pnpm better-supabase gen`, then fix the type errors it surfaces.
+   The command comes from the `@better-supabase/cli` dev dependency.
+5. Run `pnpm better-supabase doctor` and fix every error it reports (RLS off,
+   missing policies, missing grants, unindexed foreign keys, drift).
+6. Commit the generated files. CI runs `better-supabase gen --check`.
 
 Done when `gen --check` and `doctor` exit 0 and the project typechecks.
 
@@ -48,10 +57,10 @@ stay hidden.
 
 ```ts
 const result = await db.customers.findMany({
-  select: ['id', 'name'],
-  where: { status: 'active', notes: { some: { kind: 'call' } } },
-  include: { organization: { select: ['name'] } },
-  orderBy: { name: 'asc' },
+  select: ["id", "name"],
+  where: { status: "active", notes: { some: { kind: "call" } } },
+  include: { organization: { select: ["name"] } },
+  orderBy: { name: "asc" },
   limit: 20,
 });
 if (!result.ok) return result; // DbError: kind, message, status, code
@@ -82,3 +91,6 @@ See [references/troubleshooting.md](references/troubleshooting.md) for each
 https://bettersupabase.com/docs. Every page is also served as Markdown at
 `https://bettersupabase.com/docs/<path>.md`, and
 https://bettersupabase.com/llms.txt lists them all.
+
+For Supabase itself (Auth, Storage, RLS, Postgres performance), install
+Supabase's skills next to these: `npx skills add supabase/agent-skills`.

package/skills/better-supabase/references/plugins.md

@@ -1,15 +1,15 @@
 # Plugins
 
 ```ts title="src/lib/supabase.ts"
-import { defineSupabase } from 'better-supabase';
-import { actor } from 'better-supabase/plugins/actor';
-import { softDelete } from 'better-supabase/plugins/soft-delete';
-import { tenant } from 'better-supabase/plugins/tenant';
-import { timestamps } from 'better-supabase/plugins/timestamps';
-import { validation } from 'better-supabase/plugins/validation';
+import { defineSupabase } from "better-supabase";
+import { actor } from "better-supabase/plugins/actor";
+import { softDelete } from "better-supabase/plugins/soft-delete";
+import { tenant } from "better-supabase/plugins/tenant";
+import { timestamps } from "better-supabase/plugins/timestamps";
+import { validation } from "better-supabase/plugins/validation";
 
-import { schema } from './supabase/generated.ts';
-import { validators } from './supabase/generated.zod.ts';
+import { schema } from "./supabase/generated.ts";
+import { validators } from "./supabase/generated.zod.ts";
 
 export const sb = defineSupabase(schema)
   .use(timestamps())
@@ -34,14 +34,14 @@ plugins: {
 A table without the columns is left alone, and the types follow:
 `restore()` and `withDeleted` only exist on soft-delete tables.
 
-| Plugin | What it does | Don't |
-| --- | --- | --- |
-| `timestamps()` | Sets `createdAt` and `updatedAt` | set them in `create` or `update` |
-| `softDelete()` | Hides deleted rows, turns `delete` into an update, adds `restore` | filter `deletedAt: null` by hand |
-| `tenant()` | Scopes queries to the request's tenant and fills it on insert | pass `organizationId` from the client |
-| `actor()` | Sets `createdBy` and `updatedBy` | pass the user id yourself |
-| `validation()` | Validates writes with any Standard Schema | validate the same input twice |
-| `rules()` | Flags unbounded reads, missing tenants, sensitive columns and admin keys in the browser | disable a rule without a reason |
+| Plugin         | What it does                                                                            | Don't                                 |
+| -------------- | --------------------------------------------------------------------------------------- | ------------------------------------- |
+| `timestamps()` | Sets `createdAt` and `updatedAt`                                                        | set them in `create` or `update`      |
+| `softDelete()` | Hides deleted rows, turns `delete` into an update, adds `restore`                       | filter `deletedAt: null` by hand      |
+| `tenant()`     | Scopes queries to the request's tenant and fills it on insert                           | pass `organizationId` from the client |
+| `actor()`      | Sets `createdBy` and `updatedBy`                                                        | pass the user id yourself             |
+| `validation()` | Validates writes with any Standard Schema                                               | validate the same input twice         |
+| `rules()`      | Flags unbounded reads, missing tenants, sensitive columns and admin keys in the browser | disable a rule without a reason       |
 
 ## Order
 
@@ -53,4 +53,16 @@ filled it.
 RLS still decides what a user can read and write. `tenant()` makes queries
 explicit and fills the column; it doesn't replace the policy.
 
+The tenant comes from the verified `tenant_id` claim (renamed with
+`claims.tenant` in `better-supabase.config.ts`), then `app_metadata.tenant_id`.
+Never read it from `user_metadata`, a URL or a request body. When the project
+has a `permdock.config.ts`, PermDock's hook writes that claim and the
+memberships; don't run `sql add tenant` there or call `membership_claims()`
+from a hook. `sql add entitlements` is fine: `features` is not a PermDock
+claim. Add `claims: { features: 'better_supabase.feature_claims' }` to
+`supabase.hook` in `permdock.config.ts`, run `permdock supabase hook generate`,
+and `hasEntitlement(session, ...)` works. Run `permdock supabase inspect --out`
+first: with `permdock.manifest.json` present, the entitlements module reads
+PermDock's `member_<scope>_ids` helpers and doesn't add `tenant`.
+
 Docs: https://bettersupabase.com/docs/plugins.md

package/skills/better-supabase/references/troubleshooting.md

@@ -7,21 +7,21 @@ Start with `pnpm better-supabase doctor`. It checks the database, RLS,
 
 Branch on `result.error.kind`, not on the message.
 
-| Kind | Usual cause | Fix |
-| --- | --- | --- |
-| `not_found` | The row doesn't exist, or RLS hides it from this user | Check the policy with an `asUser` test before assuming the row is gone |
-| `unauthorized` | No valid session or token | Get `db` from the adapter for this request |
-| `forbidden` | RLS or a grant rejected the write | Fix the policy or the grant; don't switch to `server.admin()` |
-| `conflict` | Unique violation | Use `upsert`, or return the error to the caller |
-| `foreign_key` | Referenced row missing, or still referenced on delete | Create the parent first, or delete children |
-| `not_null`, `check`, `exclusion` | A constraint rejected the row | Validate input earlier with the `validation()` plugin |
-| `invalid_input` | Postgres couldn't parse a value (bad uuid, enum) | Validate before the call |
-| `validation` | A Standard Schema rejected the input; see `issues` | Show the issues to the user |
-| `invalid_request` | The query can't run over PostgREST (for example a relation filter on `update`) | Read the keys first, or use a database function or `better-supabase/postgres` |
-| `multiple_rows` | `findUnique` or a single-row write matched more than one row | Filter by a unique key |
-| `stale` | `update(..., { expect })` found a newer row | Reload the row and retry |
-| `serialization`, `timeout`, `network`, `rate_limited` | Transient | Retry with backoff, or surface the error |
-| `raised` | A database function raised an exception | Read `message` and `code` from the function |
+| Kind                                                  | Usual cause                                                                    | Fix                                                                           |
+| ----------------------------------------------------- | ------------------------------------------------------------------------------ | ----------------------------------------------------------------------------- |
+| `not_found`                                           | The row doesn't exist, or RLS hides it from this user                          | Check the policy with an `asUser` test before assuming the row is gone        |
+| `unauthorized`                                        | No valid session or token                                                      | Get `db` from the adapter for this request                                    |
+| `forbidden`                                           | RLS or a grant rejected the write                                              | Fix the policy or the grant; don't switch to `server.admin()`                 |
+| `conflict`                                            | Unique violation                                                               | Use `upsert`, or return the error to the caller                               |
+| `foreign_key`                                         | Referenced row missing, or still referenced on delete                          | Create the parent first, or delete children                                   |
+| `not_null`, `check`, `exclusion`                      | A constraint rejected the row                                                  | Validate input earlier with the `validation()` plugin                         |
+| `invalid_input`                                       | Postgres couldn't parse a value (bad uuid, enum)                               | Validate before the call                                                      |
+| `validation`                                          | A Standard Schema rejected the input; see `issues`                             | Show the issues to the user                                                   |
+| `invalid_request`                                     | The query can't run over PostgREST (for example a relation filter on `update`) | Read the keys first, or use a database function or `better-supabase/postgres` |
+| `multiple_rows`                                       | `findUnique` or a single-row write matched more than one row                   | Filter by a unique key                                                        |
+| `stale`                                               | `update(..., { expect })` found a newer row                                    | Reload the row and retry                                                      |
+| `serialization`, `timeout`, `network`, `rate_limited` | Transient                                                                      | Retry with backoff, or surface the error                                      |
+| `raised`                                              | A database function raised an exception                                        | Read `message` and `code` from the function                                   |
 
 ## Other symptoms
 

package/skills/better-supabase-api/SKILL.md

@@ -32,13 +32,13 @@ and `['service']` for machine callers. Rejected callers get a 401 with a
 
 ## Adapters
 
-| Where | Setup | Handler |
-| --- | --- | --- |
-| Next.js | `createNext(sb)` in `lib/supabase.server.ts` | `next.route((req, { db }) => ...)`, `next.action({ input: schema }, (input, { db }) => ...)` |
-| Hono | `createHono(sb)`, `.use('/api/*', bs.middleware())` | `c.var.db`; `bs.resource('customers', {...})` for REST |
-| oRPC | `createOrpc(sb)`, `base.use(bs.middleware())` | `bs.unwrap(context.db.customers.findMany(...))` |
-| Edge Functions | `createEdge(sb, { cors: true })` | `Deno.serve(bs.handler((req, { db }) => ...))` |
-| MCP | `createMcp(sb, { name, version, resources })` | `.tool({ name, input, run: (args, { db }) => ... })` |
+| Where          | Setup                                               | Handler                                                                                      |
+| -------------- | --------------------------------------------------- | -------------------------------------------------------------------------------------------- |
+| Next.js        | `createNext(sb)` in `lib/supabase.server.ts`        | `next.route((req, { db }) => ...)`, `next.action({ input: schema }, (input, { db }) => ...)` |
+| Hono           | `createHono(sb)`, `.use('/api/*', bs.middleware())` | `c.var.db`; `bs.resource('customers', {...})` for REST                                       |
+| oRPC           | `createOrpc(sb)`, `base.use(bs.middleware())`       | `bs.unwrap(context.db.customers.findMany(...))`                                              |
+| Edge Functions | `createEdge(sb, { cors: true })`                    | `Deno.serve(bs.handler((req, { db }) => ...))`                                               |
+| MCP            | `createMcp(sb, { name, version, resources })`       | `.tool({ name, input, run: (args, { db }) => ... })`                                         |
 
 Don't build error JSON by hand; errors become Problem Details.
 
@@ -60,8 +60,8 @@ and a replayed webhook or POST doesn't run twice.
 
 ## Testing
 
-Use `localAuth(secret)` as a resolver and `signTestJwt` / `asUser` from
-`better-supabase/testing`. See the `better-supabase-testing` skill.
+Sign tokens with `signLocalJwt` or `asUser` from `better-supabase/testing`;
+the adapter verifies them against the local JWKS. See the `better-supabase-testing` skill.
 
 Docs: https://bettersupabase.com/docs/frameworks/hono.md (and `next`,
 `orpc`, `edge`, `mcp` under `/docs/frameworks/`).

package/skills/better-supabase-api/references/adapters.md

@@ -3,11 +3,11 @@
 Each adapter wraps the same `sb` from `src/lib/supabase.ts`:
 
 ```ts title="src/lib/supabase.ts"
-import { defineSupabase } from 'better-supabase';
+import { defineSupabase } from "better-supabase";
 
-import { schema } from './supabase/generated';
+import { schema } from "./supabase/generated";
 
-export type { Functions, Models } from './supabase/generated';
+export type { Functions, Models } from "./supabase/generated";
 
 export const sb = defineSupabase(schema);
 ```
@@ -15,17 +15,17 @@ export const sb = defineSupabase(schema);
 ## Next.js
 
 ```ts title="src/lib/supabase.server.ts"
-import { createNext } from 'better-supabase/next';
+import { createNext } from "better-supabase/next";
 
-import { sb } from './supabase';
+import { sb } from "./supabase";
 
 export const next = createNext(sb);
 ```
 
 ```ts title="src/proxy.ts"
-import type { NextRequest } from 'next/server';
+import type { NextRequest } from "next/server";
 
-import { next } from './lib/supabase.server';
+import { next } from "./lib/supabase.server";
 
 export const proxy = (request: NextRequest) => next.proxy(request);
 ```
@@ -35,24 +35,29 @@ route handlers and actions read the verified token:
 
 ```ts
 const { db } = await next.server();
-export const GET = next.route((request, { db }) => db.customers.findMany({ limit: 20 }));
+export const GET = next.route((request, { db }) =>
+  db.customers.findMany({ limit: 20 }),
+);
 ```
 
 ## Hono
 
 ```ts title="src/server.ts"
-import { type BetterEnv, createHono } from 'better-supabase/hono';
-import { Hono } from 'hono';
+import { type BetterEnv, createHono } from "better-supabase/hono";
+import { Hono } from "hono";
 
-import { type Functions, type Models, sb } from './lib/supabase';
+import { type Functions, type Models, sb } from "./lib/supabase";
 
 const bs = createHono(sb);
 
 const app = new Hono<BetterEnv<Models, Functions, unknown>>()
   .onError(bs.onError)
-  .use('/api/*', bs.middleware())
-  .get('/api/me', (c) => c.json({ kind: c.var.auth.kind }))
-  .route('/api/customers', bs.resource('customers', { select: ['id', 'name'] }));
+  .use("/api/*", bs.middleware())
+  .get("/api/me", (c) => c.json({ kind: c.var.auth.kind }))
+  .route(
+    "/api/customers",
+    bs.resource("customers", { select: ["id", "name"] }),
+  );
 
 export default app;
 ```
@@ -60,10 +65,10 @@ export default app;
 ## oRPC
 
 ```ts title="src/router.ts"
-import { os } from '@orpc/server';
-import { createOrpc, type OrpcRequestContext } from 'better-supabase/orpc';
+import { os } from "@orpc/server";
+import { createOrpc, type OrpcRequestContext } from "better-supabase/orpc";
 
-import { sb } from './lib/supabase';
+import { sb } from "./lib/supabase";
 
 export const bs = createOrpc(sb);
 const authed = os.$context<OrpcRequestContext>().use(bs.middleware());
@@ -78,28 +83,28 @@ export const router = {
 ## Edge Functions
 
 ```ts title="supabase/functions/api/index.ts"
-import { createEdge } from 'better-supabase/edge';
+import { createEdge } from "better-supabase/edge";
 
-import { sb } from '../_shared/supabase.ts';
+import { sb } from "../_shared/supabase.ts";
 
 const bs = createEdge(sb, { cors: true });
 
 Deno.serve(
-  bs.resources({ customers: { select: ['id', 'name'] } }, { basePath: '/api' }),
+  bs.resources({ customers: { select: ["id", "name"] } }, { basePath: "/api" }),
 );
 ```
 
 ## MCP
 
 ```ts title="supabase/functions/mcp/index.ts"
-import { createMcp } from 'better-supabase/mcp';
+import { createMcp } from "better-supabase/mcp";
 
-import { sb } from '../_shared/supabase.ts';
+import { sb } from "../_shared/supabase.ts";
 
 const mcp = createMcp(sb, {
-  name: 'crm',
-  version: '0.1.0',
-  resources: { customers: { select: ['id', 'name'] } },
+  name: "crm",
+  version: "0.1.0",
+  resources: { customers: { select: ["id", "name"] } },
 });
 
 Deno.serve(mcp.fetch);

package/skills/better-supabase-testing/SKILL.md

@@ -11,7 +11,8 @@ supabase-js, and don't use the service role for anything a user does.
 ## Workflow: test a table or policy
 
 1. Start the stack (`supabase start`) and write `.env.local` with
-   `better-supabase env`.
+   `better-supabase env`. In a sandbox without Docker, start it with
+   `SUPABASE_EXPERIMENTAL_STACK=1` (the Supabase CLI's native stack).
 2. Add the rows the test needs to `supabase/seed.ts`, including one row
    owned by another tenant, then `supabase db reset`.
 3. Write the RLS test with `asUser` for each role that matters.
@@ -25,27 +26,30 @@ again once you restore it.
 ## Setup
 
 - `better-supabase env` writes the URL and keys to `.env.local`; load it in the test setup.
+- `better-supabase keys` creates `supabase/signing_keys.json`. Set `signing_keys_path = "./signing_keys.json"` under `[auth]` in `supabase/config.toml`, gitignore the file and restart the stack. `asUser` signs ES256 tokens with it.
 - Typed fixtures live in `supabase/seed.ts`:
 
 ```ts
-import { defineSeed } from 'better-supabase/testing';
-import { sb } from '../src/lib/supabase.ts';
+import { defineSeed } from "better-supabase/testing";
+import { sb } from "../src/lib/supabase.ts";
 
 export const seed = defineSeed(sb, {
-  organizations: { acme: { id: ACME, name: 'Acme' } },
-  customers: { first: { id: FIRST, organizationId: ACME, name: 'First' } },
+  organizations: { acme: { id: ACME, name: "Acme" } },
+  customers: { first: { id: FIRST, organizationId: ACME, name: "First" } },
 });
 ```
 
-  `better-supabase seed` renders them to SQL for `supabase db reset`, and
-  tests import the same rows (`seed.rows.customers.first.id`).
+`better-supabase seed` renders them to SQL for `supabase db reset`, and
+tests import the same rows (`seed.rows.customers.first.id`).
 
 ## RLS tests
 
 ```ts
-const alice = await asUser(sb, { sub: aliceId, org_id: ACME }, { postgres });
+const alice = await asUser(sb, { sub: aliceId, tenant_id: ACME }, { postgres });
 expect(await alice.db.customers.count().orThrow()).toBe(1);
-expect(await alice.db.customers.findById(OTHER_ORG_CUSTOMER)).toMatchObject({ ok: false });
+expect(await alice.db.customers.findById(OTHER_ORG_CUSTOMER)).toMatchObject({
+  ok: false,
+});
 ```
 
 - Check both directions: the user sees their own rows and never sees another tenant's.
@@ -54,8 +58,8 @@ expect(await alice.db.customers.findById(OTHER_ORG_CUSTOMER)).toMatchObject({ ok
 
 ## API tests
 
-Pass `auth: { resolvers: [localAuth(LOCAL_JWT_SECRET)] }` to the adapter and
-send `authorization: Bearer ${alice.token}`.
+Send `authorization: Bearer ${alice.token}` (or a token from `signLocalJwt`).
+The adapter verifies it against the local JWKS; no test-only resolver is needed.
 
 ## pgTAP
 

package/bin/better-supabase.js

@@ -1,3 +0,0 @@
-#!/usr/bin/env node
-// Checked in so pnpm can link the bin on a fresh install, before dist/ is built.
-import '../dist/cli/bin.js';

package/dist/casing-da0uRTqt.js

@@ -1,14 +0,0 @@
-//#region src/casing/index.ts
-/** `first_name` to `firstName`. Leaves already camel-cased names untouched. */
-function toCamel(name) {
-	return name.replace(/_+([a-z0-9])/g, (_, char) => char.toUpperCase());
-}
-/** `firstName` to `first_name`. */
-function toSnake(name) {
-	return name.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/([A-Z])([A-Z][a-z])/g, "$1_$2").toLowerCase();
-}
-function applyCasing(name, casing) {
-	return casing === "camel" ? toCamel(name) : name;
-}
-//#endregion
-export { toCamel as n, toSnake as r, applyCasing as t };

package/dist/cli/bin.d.ts

@@ -1 +0,0 @@
-export {}