better-supabase 0.1.0 → 0.3.0

package/dist/entitlements-DvJXoI02.d.ts

@@ -0,0 +1,42 @@
+import { t as AuthSession } from "./view-3Po_PVlr.js";
+//#region src/auth/entitlements.d.ts
+/**
+ * One entry of the `memberships` claim, in PermDock's shape. PermDock strips
+ * `null`s, so optional fields are absent rather than `null`.
+ */
+interface MembershipClaim {
+  /** The scope the membership is in, e.g. `tenant` or `organization`. */
+  readonly scope: string;
+  readonly id: string;
+  /** Parent scopes, e.g. `{ organization: '...' }` for a project membership. */
+  readonly within?: Readonly<Record<string, string>>;
+  readonly roles: readonly string[];
+  readonly via?: string;
+  /** Unix seconds. */
+  readonly expiresAt?: number;
+  readonly grantedBy?: string;
+  readonly reason?: string;
+  readonly member?: {
+    readonly group: string;
+  };
+  readonly managedBy?: "idp";
+  /** Seats, not plan features: those are in the `features` claim. */
+  readonly entitlements?: readonly string[];
+}
+/**
+ * Entitlement keys of the `features` claim: the literal union when
+ * `sb.claims(schema)` declares one (`z.enum([...])`), otherwise `string`.
+ */
+type EntitlementKey<C> = C extends {
+  readonly features?: infer F;
+} ? NonNullable<F> extends Readonly<Record<string, readonly (infer K)[]>> ? K extends string ? K : string : string : string;
+/**
+ * Whether the session's plan-features claim grants `key` in `tenantId`.
+ * `claim` is `config.claims.features` (default `features`), the claim
+ * `better_supabase.feature_claims()` fills. The claim is as fresh as the
+ * token: enforce it in RLS with `better_supabase.has_entitlement()`, and
+ * refresh the session after checkout.
+ */
+declare function hasEntitlement<C>(session: AuthSession<C>, tenantId: string, key: EntitlementKey<C>, claim?: string): boolean;
+//#endregion
+export { MembershipClaim as n, hasEntitlement as r, EntitlementKey as t };

package/dist/env/index.js

@@ -1,2 +1,204 @@
-import { a as parseEnv, i as loadEnv, n as EnvValidationError, o as publicEnv, r as envSchema, s as toServerEnv, t as ENV_VARIABLES } from "../env-BEToab0I.js";
+//#region src/env/index.ts
+const PREFIXES = [
+	"",
+	"NEXT_PUBLIC_",
+	"VITE_",
+	"PUBLIC_",
+	"EXPO_PUBLIC_",
+	"NUXT_PUBLIC_"
+];
+const ENV_VARIABLES = {
+	url: PREFIXES.map((prefix) => `${prefix}SUPABASE_URL`),
+	publishableKey: PREFIXES.flatMap((prefix) => [`${prefix}SUPABASE_PUBLISHABLE_KEY`, `${prefix}SUPABASE_PUBLISHABLE_DEFAULT_KEY`]),
+	secretKey: ["SUPABASE_SECRET_KEY"],
+	dbUrl: ["SUPABASE_DB_URL", "DATABASE_URL"],
+	jwksUrl: ["SUPABASE_JWKS_URL"],
+	readUrl: ["SUPABASE_READ_URL"]
+};
+const LOOPBACK = /^(localhost|127(?:\.\d{1,3}){3}|\[::1\])$/;
+const HOSTED = /^([a-z0-9]{20})\.supabase\.co$/;
+var EnvValidationError = class extends Error {
+	name = "EnvValidationError";
+	issues;
+	constructor(issues) {
+		super(`Invalid Supabase environment:\n${issues.map((issue) => `  - ${issue.variables[0] ?? "env"}: ${issue.message}`).join("\n")}`);
+		this.issues = issues;
+	}
+};
+function first(source, names) {
+	for (const name of names) {
+		const value = source[name]?.trim();
+		if (value) return value;
+	}
+}
+/** `SUPABASE_*_KEYS` JSON objects, as `@supabase/server` reads them. */
+function keySet(source, name, kind, issues) {
+	const raw = source[name];
+	if (!raw) return void 0;
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		parsed = void 0;
+	}
+	const entries = typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? Object.entries(parsed) : [];
+	if (entries.length === 0 || entries.some(([, value]) => typeof value !== "string")) {
+		issues.push({
+			variables: [name],
+			message: "must be a JSON object of key names to keys"
+		});
+		return;
+	}
+	const keys = {};
+	for (const [key, value] of entries) if (checkKey(value, kind, [name], issues)) keys[key] = value;
+	return keys;
+}
+function preferred(keys) {
+	if (!keys) return void 0;
+	return keys["default"] ?? Object.values(keys)[0];
+}
+function checkUrl(value, variables, issues) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		issues.push({
+			variables,
+			message: "is not a valid URL"
+		});
+		return;
+	}
+	if (url.protocol === "https:") return url;
+	if (url.protocol === "http:" && LOOPBACK.test(url.hostname)) return url;
+	issues.push({
+		variables,
+		message: "must use https (http is only allowed for localhost / 127.0.0.1 / [::1])"
+	});
+}
+function checkKey(value, kind, variables, issues) {
+	if (value.startsWith(`sb_${kind}_`)) return true;
+	if (value.startsWith("eyJ")) issues.push({
+		variables,
+		message: `is a legacy JWT key; use the new sb_${kind}_ key (Project Settings > API Keys)`
+	});
+	else if (value.startsWith(kind === "publishable" ? "sb_secret_" : "sb_publishable_")) issues.push({
+		variables,
+		message: kind === "publishable" ? "holds a secret key; never expose sb_secret_ keys as publishable" : "holds a publishable key, not a secret key"
+	});
+	else issues.push({
+		variables,
+		message: `must start with sb_${kind}_`
+	});
+	return false;
+}
+/**
+* Reads and validates Supabase settings. Accepts the `SUPABASE_`,
+* `NEXT_PUBLIC_`, `VITE_`, `PUBLIC_`, `EXPO_PUBLIC_` and `NUXT_PUBLIC_`
+* spellings. Issues name variables, never values.
+*/
+function parseEnv(source, options = {}) {
+	const issues = [];
+	const required = new Set(options.require ?? []);
+	const rawUrl = first(source, ENV_VARIABLES.url);
+	const url = rawUrl ? checkUrl(rawUrl, ENV_VARIABLES.url, issues) : void 0;
+	if (!rawUrl) issues.push({
+		variables: ENV_VARIABLES.url,
+		message: "is not set"
+	});
+	const publishableKeys = keySet(source, "SUPABASE_PUBLISHABLE_KEYS", "publishable", issues);
+	const singlePublishable = first(source, ENV_VARIABLES.publishableKey);
+	const publishableKey = singlePublishable ?? preferred(publishableKeys);
+	if (!publishableKey) issues.push({
+		variables: ENV_VARIABLES.publishableKey,
+		message: "is not set"
+	});
+	else if (singlePublishable) checkKey(publishableKey, "publishable", ENV_VARIABLES.publishableKey, issues);
+	const namedSecrets = keySet(source, "SUPABASE_SECRET_KEYS", "secret", issues);
+	const singleSecret = first(source, ENV_VARIABLES.secretKey);
+	const secretKey = singleSecret ?? preferred(namedSecrets);
+	if (singleSecret) checkKey(singleSecret, "secret", ENV_VARIABLES.secretKey, issues);
+	else if (!secretKey && required.has("secretKey")) issues.push({
+		variables: ENV_VARIABLES.secretKey,
+		message: "is not set"
+	});
+	const dbUrl = first(source, ENV_VARIABLES.dbUrl);
+	if (dbUrl && !/^postgres(ql)?:\/\//.test(dbUrl)) issues.push({
+		variables: ENV_VARIABLES.dbUrl,
+		message: "must be a postgres:// connection string"
+	});
+	else if (!dbUrl && required.has("dbUrl")) issues.push({
+		variables: ENV_VARIABLES.dbUrl,
+		message: "is not set"
+	});
+	const rawJwks = first(source, ENV_VARIABLES.jwksUrl);
+	const jwksOverride = rawJwks ? checkUrl(rawJwks, ENV_VARIABLES.jwksUrl, issues) : void 0;
+	const rawRead = first(source, ENV_VARIABLES.readUrl);
+	const readUrl = rawRead ? checkUrl(rawRead, ENV_VARIABLES.readUrl, issues) : void 0;
+	if (issues.length > 0 || !url || !publishableKey) return {
+		ok: false,
+		issues
+	};
+	const base = url.href.replace(/\/+$/, "");
+	const projectRef = HOSTED.exec(url.hostname)?.[1];
+	return {
+		ok: true,
+		env: {
+			url: base,
+			publishableKey,
+			jwksUrl: jwksOverride ?? new URL(`${base}/auth/v1/.well-known/jwks.json`),
+			...secretKey ? {
+				secretKey,
+				secretKeys: {
+					...namedSecrets,
+					default: secretKey
+				}
+			} : {},
+			...dbUrl ? { dbUrl } : {},
+			...projectRef ? { projectRef } : {},
+			...readUrl ? { readUrl: readUrl.href.replace(/\/+$/, "") } : {}
+		}
+	};
+}
+function processEnv() {
+	return globalThis.process?.env ?? {};
+}
+/** Like `parseEnv`, but throws `EnvValidationError`. Reads `process.env` by default. */
+function loadEnv(source = processEnv(), options = {}) {
+	const result = parseEnv(source, options);
+	if (!result.ok) throw new EnvValidationError(result.issues);
+	return result.env;
+}
+/** The env validator as a Standard Schema, for t3-env, framework config or any validator slot. */
+function envSchema(options = {}) {
+	return { "~standard": {
+		version: 1,
+		vendor: "better-supabase",
+		validate(value) {
+			if (typeof value !== "object" || value === null) return { issues: [{ message: "Expected an environment object" }] };
+			const result = parseEnv(value, options);
+			if (result.ok) return { value: result.env };
+			return { issues: result.issues.map((issue) => ({
+				message: `${issue.variables[0] ?? "env"} ${issue.message}`,
+				path: issue.variables.slice(0, 1)
+			})) };
+		}
+	} };
+}
+/** The parts that are safe in client bundles. */
+function publicEnv(env) {
+	return {
+		url: env.url,
+		publishableKey: env.publishableKey
+	};
+}
+/** Converts to `@supabase/server`'s `SupabaseEnv` (the `env` option of `withSupabase`). */
+function toServerEnv(env) {
+	return {
+		url: env.url,
+		publishableKeys: { default: env.publishableKey },
+		secretKeys: env.secretKeys ?? (env.secretKey ? { default: env.secretKey } : {}),
+		jwks: env.jwksUrl
+	};
+}
+//#endregion
 export { ENV_VARIABLES, EnvValidationError, envSchema, loadEnv, parseEnv, publicEnv, toServerEnv };

package/dist/events/index.d.ts

@@ -1,2 +1,2 @@
-import { a as HttpMode, c as RowEventData, d as httpSink, f as isCloudEvent, i as ForwardOptions, l as forwardMutations, m as toHttp, n as CloudEventOptions, o as HttpSinkOptions, p as toCloudEvents, r as EventSink, s as ROW_EVENT_TYPES, t as CloudEvent, u as fromHttp } from "../index-DQVvHzjW.js";
+import { a as HttpMode, c as RowEventData, d as httpSink, f as isCloudEvent, i as ForwardOptions, l as forwardMutations, m as toHttp, n as CloudEventOptions, o as HttpSinkOptions, p as toCloudEvents, r as EventSink, s as ROW_EVENT_TYPES, t as CloudEvent, u as fromHttp } from "../index-GV77NpRP.js";
 export { CloudEvent, CloudEventOptions, EventSink, ForwardOptions, HttpMode, HttpSinkOptions, ROW_EVENT_TYPES, RowEventData, forwardMutations, fromHttp, httpSink, isCloudEvent, toCloudEvents, toHttp };

package/dist/events/index.js

@@ -1,2 +1,140 @@
-import { a as isCloudEvent, i as httpSink, n as forwardMutations, o as toCloudEvents, r as fromHttp, s as toHttp, t as ROW_EVENT_TYPES } from "../events-BuzTgn2D.js";
+import { n as nowInstant } from "../temporal-BwshQk0W.js";
+//#region src/events/index.ts
+const ROW_EVENT_TYPES = {
+	insert: "dev.better-supabase.row.created",
+	upsert: "dev.better-supabase.row.upserted",
+	update: "dev.better-supabase.row.updated",
+	delete: "dev.better-supabase.row.deleted"
+};
+function subjectOf(meta, table, row) {
+	const key = meta?.tables[table]?.primaryKey;
+	if (!key || key.length === 0) return void 0;
+	const values = key.map((column) => row[column]);
+	if (values.some((value) => value === void 0 || value === null)) return void 0;
+	return `${table}/${values.map((value) => encodeURIComponent(String(value))).join(",")}`;
+}
+/**
+* One CloudEvent per mutated row: `dev.better-supabase.row.created` with the
+* app-cased row as `data`, the primary key as `subject`, the tenant as
+* `partitionkey` and the actor as `actorid`.
+*/
+function toCloudEvents(notice, options) {
+	const type = options.typePrefix ? `${options.typePrefix}.row.${ROW_EVENT_TYPES[notice.kind].split(".").at(-1)}` : ROW_EVENT_TYPES[notice.kind];
+	const time = (options.now ?? nowInstant)().toString();
+	return notice.rows.map((row) => {
+		const subject = subjectOf(options.meta, notice.table, row);
+		return {
+			specversion: "1.0",
+			id: options.id?.() ?? crypto.randomUUID(),
+			source: options.source,
+			type,
+			...subject ? { subject } : {},
+			time,
+			datacontenttype: "application/json",
+			data: {
+				table: notice.table,
+				row
+			},
+			...notice.context.tenant ? { partitionkey: notice.context.tenant } : {},
+			...notice.context.actor?.id ? { actorid: notice.context.actor.id } : {}
+		};
+	});
+}
+/**
+* Sends a CloudEvent for every mutation to `sink`. Returns a function that
+* stops forwarding. Use an outbox (SQL kit) when events must not be lost.
+*/
+function forwardMutations(sb, sink, options) {
+	return sb.events.on("mutation", (notice) => {
+		if (options.filter && !options.filter(notice)) return;
+		const events = toCloudEvents(notice, {
+			...options,
+			meta: sb.meta
+		});
+		if (events.length === 0) return;
+		const report = (error) => {
+			(options.onError ?? ((cause) => {
+				sb.events.logger.error("event sink failed", { cause });
+			}))(error, events);
+		};
+		try {
+			Promise.resolve(sink.send(events)).catch(report);
+		} catch (error) {
+			report(error);
+		}
+	});
+}
+const STRUCTURED = "application/cloudevents+json";
+const BATCH = "application/cloudevents-batch+json";
+/** The HTTP protocol binding: headers and body for one event (or a batch). */
+function toHttp(events, mode = "structured") {
+	const list = Array.isArray(events) ? events : [events];
+	switch (mode) {
+		case "batch": return [{
+			headers: { "content-type": BATCH },
+			body: JSON.stringify(list)
+		}];
+		case "structured": return list.map((event) => ({
+			headers: { "content-type": STRUCTURED },
+			body: JSON.stringify(event)
+		}));
+		case "binary": return list.map((event) => {
+			const headers = {};
+			for (const [key, value] of Object.entries(event)) {
+				if (key === "data" || key === "datacontenttype" || value === void 0) continue;
+				headers[`ce-${key}`] = encodeURIComponent(String(value)).replaceAll("%20", " ");
+			}
+			headers["content-type"] = event.datacontenttype ?? "application/json";
+			return {
+				headers,
+				body: event.data === void 0 ? "" : JSON.stringify(event.data)
+			};
+		});
+		default: throw new TypeError(`Unknown CloudEvents mode ${String(mode)}`);
+	}
+}
+function isCloudEvent(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const event = value;
+	return event["specversion"] === "1.0" && typeof event["id"] === "string" && typeof event["source"] === "string" && typeof event["type"] === "string";
+}
+/** Reads CloudEvents from a request in any of the three HTTP modes. */
+async function fromHttp(request) {
+	const contentType = request.headers.get("content-type") ?? "";
+	const text = await request.text();
+	if (contentType.startsWith(BATCH)) {
+		const parsed = JSON.parse(text);
+		if (!Array.isArray(parsed) || !parsed.every(isCloudEvent)) throw new TypeError("Invalid CloudEvents batch");
+		return parsed;
+	}
+	if (contentType.startsWith(STRUCTURED)) {
+		const parsed = JSON.parse(text);
+		if (!isCloudEvent(parsed)) throw new TypeError("Invalid CloudEvent");
+		return [parsed];
+	}
+	const event = {};
+	for (const [key, value] of request.headers) if (key.startsWith("ce-")) event[key.slice(3)] = decodeURIComponent(value);
+	if (contentType) event["datacontenttype"] = contentType;
+	if (text) event["data"] = contentType.includes("json") ? JSON.parse(text) : text;
+	if (!isCloudEvent(event)) throw new TypeError("Request is not a CloudEvent");
+	return [event];
+}
+/** POSTs events to `url`. Non-2xx responses reject. */
+function httpSink(url, options = {}) {
+	const send = options.fetch ?? fetch;
+	return { async send(events) {
+		for (const message of toHttp(events, options.mode ?? "batch")) {
+			const response = await send(url, {
+				method: "POST",
+				headers: {
+					...options.headers,
+					...message.headers
+				},
+				body: message.body
+			});
+			if (!response.ok) throw new Error(`Event sink responded ${String(response.status)}`);
+		}
+	} };
+}
+//#endregion
 export { ROW_EVENT_TYPES, forwardMutations, fromHttp, httpSink, isCloudEvent, toCloudEvents, toHttp };

package/dist/{events-2OJsVG_d.d.ts → events-Do8jXh4D.d.ts}

@@ -1,6 +1,6 @@
-import { g as Operation } from "./executor-Bazhgsgq.js";
-import { p as DbError } from "./result-CTkCZ6JA.js";
-import { h as RequestContext, l as MutationKind } from "./plugin-HvGqCurB.js";
+import { g as Operation } from "./executor-DynmIWhq.js";
+import { p as DbError } from "./result-c2OYgCV2.js";
+import { h as RequestContext, l as MutationKind } from "./plugin-DVRB8qNE.js";
 //#region src/core/logger.d.ts
 type LogFields = Readonly<Record<string, unknown>>;
 /**

package/dist/{executor-Bje4suQF.d.ts → executor-B26lgbHD.d.ts}

@@ -1,5 +1,5 @@
-import { r as Executor } from "./executor-Bazhgsgq.js";
-import { y as RawDbError } from "./result-CTkCZ6JA.js";
+import { r as Executor } from "./executor-DynmIWhq.js";
+import { y as RawDbError } from "./result-c2OYgCV2.js";
 //#region src/postgres/executor.d.ts
 /**
  * Anything that runs parameterized SQL: `ctx.postgres` from

package/dist/{executor-Ceq60hPM.js → executor-C57jx2pn.js}

@@ -1,6 +1,6 @@
 import { c as mapDbError, n as dbError } from "./errors-Bl3rkOzo.js";
 import { i as ok, n as err, o as toDbError } from "./result-DWXatkd6.js";
-import { t as compileSql } from "./sql-M8l3fnS0.js";
+import { t as compileSql } from "./sql-BIgk12ew.js";
 //#region src/postgres/executor.ts
 function isPgError(value) {
 	return typeof value === "object" && value !== null && typeof value.code === "string";
@@ -25,6 +25,11 @@ async function run(client, plan, op) {
 		const [first] = await client.queryRaw(plan.count.text, [...plan.count.params]);
 		count = first?.count ?? 0;
 	} else if (op.kind !== "select") count = rows.length;
+	for (const next of plan.chunks ?? []) {
+		const more = await run(client, next, op);
+		rows.push(...more.rows);
+		count = (count ?? 0) + (more.count ?? 0);
+	}
 	return {
 		rows,
 		count
@@ -74,7 +79,7 @@ async function executeOn(client, op, context) {
 	if (context.signal?.aborted) return err(dbError("aborted", "The request was aborted"));
 	let result;
 	try {
-		result = await run(client, plan, op);
+		result = plan.chunks && client.transaction ? await client.transaction((scoped) => run(scoped, plan, op)) : await run(client, plan, op);
 	} catch (cause) {
 		const raw = fromPgError(cause);
 		return err(raw ? mapDbError(raw, context.errorMappers) : toDbError(cause));

package/dist/{executor-Bazhgsgq.d.ts → executor-DynmIWhq.d.ts}

@@ -1,5 +1,5 @@
-import { A as TableMeta, o as Codec, x as RelationMeta } from "./types-C2fslP1z.js";
-import { o as Result, v as ErrorMapper } from "./result-CTkCZ6JA.js";
+import { P as TableMeta, T as RelationMeta, c as Codec } from "./types-DONv9SHN.js";
+import { o as Result, v as ErrorMapper } from "./result-c2OYgCV2.js";
 //#region src/ir/types.d.ts
 /**
  * The query IR. Every repository call becomes one of these operations; the

package/dist/guards-BnzDvFrz.js

@@ -0,0 +1,10 @@
+//#region src/core/guards.ts
+/**
+* `Array.isArray` narrows `unknown` and readonly arrays to `any[]`; this keeps
+* the element type (or `unknown`).
+*/
+function isList(value) {
+	return Array.isArray(value);
+}
+//#endregion
+export { isList as t };

package/dist/hono/index.d.ts

@@ -1,8 +1,8 @@
-import { k as TableKey, n as AnyModels, t as AnyFunctions } from "../types-C2fslP1z.js";
-import { t as BetterSupabase } from "../define-CTfWw-SS.js";
-import { r as AuthState } from "../resolve-DW8h9NPm.js";
-import { d as ServerContext, f as ServerOptions, l as BetterServer, n as GuardOptions } from "../respond-PoTpy5DT.js";
-import { i as ResourceRouteOptions } from "../resource-SkPTRJDD.js";
+import { N as TableKey, n as AnyModels, t as AnyFunctions } from "../types-DONv9SHN.js";
+import { t as BetterSupabase } from "../define-DUbydmJa.js";
+import { r as AuthState } from "../resolve-BRciX2jK.js";
+import { d as ServerContext, f as ServerOptions, l as BetterServer, n as GuardOptions } from "../respond-DAkPIdTH.js";
+import { a as ResourceRouteOptions } from "../resource-CwVgiI5q.js";
 import { Context, ErrorHandler, Hono, MiddlewareHandler } from "hono";
 //#region src/hono/index.d.ts
 /** Hono `Env` with the request's better-supabase context in `c.var`. */

package/dist/hono/index.js

@@ -1,7 +1,7 @@
 import { n as dbError, r as dbErrorOf } from "../errors-Bl3rkOzo.js";
-import { a as problemResponse } from "../problem-DPu6Fh-t.js";
-import { i as respond, n as guard, o as createServer, s as extendServer, t as defaultExpose } from "../respond-4-dhoV7x.js";
-import { t as defineResource } from "../resource-CYiu6Ygi.js";
+import { a as problemResponse } from "../problem-CGt1ADix.js";
+import { i as respond, n as guard, o as createServer, s as extendServer, t as defaultExpose } from "../respond-C44EZAJo.js";
+import { t as defineResource } from "../resource-D30rp0GN.js";
 import { Hono } from "hono";
 //#region src/hono/index.ts
 function contextOf(c) {
@@ -31,7 +31,7 @@ function createHono(sb, options = {}) {
 		middleware(middlewareOptions = {}) {
 			return async (c, next) => {
 				const ctx = await server.context(c.req.raw, { refresh: middlewareOptions.refresh ?? false });
-				const denied = guard(ctx.auth, middlewareOptions.allow, middlewareOptions.aal);
+				const denied = guard(ctx.auth, middlewareOptions.allow, middlewareOptions.aal, middlewareOptions.scopes);
 				if (denied) return ctx.resolution.apply(problemResponse(denied, {
 					instance: new URL(c.req.url).pathname,
 					expose

package/dist/{index-Hf8PP9sP.d.ts → index-BNsABq7P.d.ts}

@@ -1,16 +1,16 @@
-import { p as DbError } from "./result-CTkCZ6JA.js";
-import { Z as QuerySpec } from "./define-CTfWw-SS.js";
-import { i as BrowserAuth, t as AuthSnapshot } from "./index-Sw43J8HG.js";
+import { p as DbError } from "./result-c2OYgCV2.js";
+import { Z as QuerySpec } from "./define-DUbydmJa.js";
+import { i as BrowserAuth, t as AuthSnapshot } from "./index-UJ-LUxtI.js";
 import { n as TemplateValues } from "./template-mbvlysOo.js";
-import { t as AuthSession } from "./view-B0ltUmTi.js";
-import { a as LiveSource, g as Topic, h as SubscriptionStatus, p as SubscribeOptions, r as LiveCountSeed, u as EventSchemas, v as TopicHandlers, y as TopicMessage } from "./live-6b9i72Ux.js";
-import "./entitlements-BBg61DQZ.js";
-import "./session-C3osL21k.js";
+import { t as AuthSession } from "./view-3Po_PVlr.js";
+import { a as LiveSource, g as Topic, h as SubscriptionStatus, p as SubscribeOptions, r as LiveCountSeed, u as EventSchemas, v as TopicHandlers, y as TopicMessage } from "./live-QE3UPbGm.js";
+import "./entitlements-DvJXoI02.js";
+import "./react/session.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { ReactNode } from "react";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 import { QueryClient } from "@tanstack/query-core";
-//#region src/react/index.d.ts
+//#region src/react/hooks.d.ts
 /** The parts of `createBrowser()` the provider needs. */
 interface BrowserLike {
   readonly sb: LiveSource;
@@ -37,13 +37,17 @@ interface BetterHooks<B extends BrowserLike> {
   readonly useQueries: () => B["queries"];
   readonly useSupabase: () => SupabaseClient;
   readonly useAuth: () => AuthSnapshot;
-  /** `useSession()` with the claims typed by the browser's `sb.claims(schema)`. */
-  readonly useSession: () => AuthSession<ClaimsOf<B>>;
+  /** `useSession()` typed by the browser's `sb.claims(schema)` and `sb.userMetadata(schema)`. */
+  readonly useSession: () => AuthSession<ClaimsOf<B>, ProfileOf<B>>;
 }
 /** The claims type of a browser's `sb.claims(schema)`, `unknown` without one. */
 type ClaimsOf<B extends BrowserLike> = B["sb"] extends {
   readonly claimsSchema: StandardSchemaV1<unknown, infer C> | undefined;
 } ? C : unknown;
+/** The profile type of a browser's `sb.userMetadata(schema)`, `unknown` without one. */
+type ProfileOf<B extends BrowserLike> = B["sb"] extends {
+  readonly userMetadataSchema: StandardSchemaV1<unknown, infer P> | undefined;
+} ? P : unknown;
 /**
  * Hooks typed for your schema.
  *
@@ -71,8 +75,8 @@ interface BroadcastOptions extends Omit<SubscribeOptions, "onStatus"> {
 declare function useBroadcast<P extends string, E extends EventSchemas>(topic: Topic<P, E>, values: TemplateValues<P> | null | undefined, handlers?: TopicHandlers<E>, options?: BroadcastOptions): SubscriptionStatus;
 interface LiveQueryHookOptions {
   /**
-   * Tenant for tenant-scoped tables. Defaults to the `org_id` claim
-   * (top-level or in `app_metadata`).
+   * Tenant for tenant-scoped tables. Defaults to the `config.claims.tenant`
+   * claim (`tenant_id`, top-level or in `app_metadata`).
    */
   readonly tenant?: string;
   /** Defaults to 100 ms. */
@@ -113,4 +117,4 @@ interface LiveCount {
  */
 declare function useLiveCount(source: QuerySpec<string, "count", number> | LiveCountSeed | null | undefined, options?: LiveCountHookOptions): LiveCount;
 //#endregion
-export { BrowserLike as a, LiveCountHookOptions as c, useAuth as d, useBroadcast as f, useSupabase as h, BroadcastOptions as i, LiveQueryHookOptions as l, useLiveQuery as m, BetterSupabaseProvider as n, ClaimsOf as o, useLiveCount as p, BetterSupabaseProviderProps as r, LiveCount as s, BetterHooks as t, createHooks as u };
+export { BrowserLike as a, LiveCountHookOptions as c, createHooks as d, useAuth as f, useSupabase as g, useLiveQuery as h, BroadcastOptions as i, LiveQueryHookOptions as l, useLiveCount as m, BetterSupabaseProvider as n, ClaimsOf as o, useBroadcast as p, BetterSupabaseProviderProps as r, LiveCount as s, BetterHooks as t, ProfileOf as u };