better-supabase 0.1.0 → 0.3.0

package/dist/next/index.d.ts

@@ -1,12 +1,12 @@
-import { n as AnyModels, t as AnyFunctions } from "../types-C2fslP1z.js";
-import { p as DbError } from "../result-CTkCZ6JA.js";
-import { B as ReadSet, P as DbStats, Z as QuerySpec, l as CacheAdapter, t as BetterSupabase } from "../define-CTfWw-SS.js";
-import { n as AmrEntry, s as Impersonator, t as Aal } from "../mfa-TVia554c.js";
-import { r as AuthState } from "../resolve-DW8h9NPm.js";
-import { d as ServerContext, f as ServerOptions, l as BetterServer, n as GuardOptions, t as AuthKind } from "../respond-PoTpy5DT.js";
-import { n as toSession, t as AuthSession } from "../view-B0ltUmTi.js";
-import { r as LiveCountSeed, t as CountRunner } from "../live-6b9i72Ux.js";
-import { n as hasEntitlement, t as EntitlementKey } from "../entitlements-BBg61DQZ.js";
+import { n as AnyModels, t as AnyFunctions } from "../types-DONv9SHN.js";
+import { p as DbError } from "../result-c2OYgCV2.js";
+import { B as ReadSet, P as DbStats, Z as QuerySpec, l as CacheAdapter, t as BetterSupabase } from "../define-DUbydmJa.js";
+import { n as AmrEntry, s as Impersonator, t as Aal } from "../mfa-x3V3vGh-.js";
+import { r as AuthState } from "../resolve-BRciX2jK.js";
+import { d as ServerContext, f as ServerOptions, l as BetterServer, n as GuardOptions, t as AuthKind } from "../respond-DAkPIdTH.js";
+import { n as toSession, t as AuthSession } from "../view-3Po_PVlr.js";
+import { r as LiveCountSeed, t as CountRunner } from "../live-QE3UPbGm.js";
+import { n as MembershipClaim, r as hasEntitlement, t as EntitlementKey } from "../entitlements-DvJXoI02.js";
 import { NextRequest } from "next/server.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/next/collector.d.ts
@@ -17,8 +17,8 @@ interface DbBudget {
   readonly waves?: number;
 }
 //#endregion
-//#region src/next/index.d.ts
-export interface NextOptions extends ServerOptions {
+//#region src/next/create.d.ts
+interface NextOptions extends ServerOptions {
   /** Invalidate `tagFor(table)` cache tags after mutations. Defaults to true. */
   readonly cacheTags?: boolean;
   /** Include internal error messages in Problem Details. Defaults to development only. */
@@ -26,7 +26,7 @@ export interface NextOptions extends ServerOptions {
   /** Per-request database call counts. See the Budget docs. */
   readonly debug?: NextDebugOptions;
 }
-export interface NextDebugOptions {
+interface NextDebugOptions {
   /** Collect outside development too, e.g. for e2e runs against `next start`. */
   readonly enabled?: boolean;
   /** Header with `calls;waves;ms` on route handler responses. Defaults to `x-bs-db-calls`. */
@@ -38,7 +38,7 @@ export interface NextDebugOptions {
 }
 /** Response header with the URL of the request's totals on `next.debugRoute()`. */
 export declare const STATS_URL_HEADER = "x-bs-stats";
-export interface ProxyOptions<C = unknown> {
+interface ProxyOptions<C = unknown, U = unknown> {
   /**
    * Another middleware to compose with, such as next-intl's. It runs on the
    * original request, alongside auth; its rewrite, redirect or request
@@ -46,16 +46,16 @@ export interface ProxyOptions<C = unknown> {
    */
   readonly before?: (request: NextRequest) => Response | undefined | Promise<Response | undefined>;
   /** Answer before rendering, e.g. redirect signed-out users. Refreshed cookies are kept. */
-  readonly protect?: (auth: AuthState<C>, request: NextRequest) => Response | undefined | Promise<Response | undefined>;
+  readonly protect?: (auth: AuthState<C, U>, request: NextRequest) => Response | undefined | Promise<Response | undefined>;
   /** Post-processes the final response; return a new one to replace it. */
-  readonly after?: (response: Response, auth: AuthState<C>) => Response | undefined | void | Promise<Response | undefined | void>;
+  readonly after?: (response: Response, auth: AuthState<C, U>) => Response | undefined | void | Promise<Response | undefined | void>;
   /**
    * Adds `Server-Timing: bs-proxy;dur=..., bs-verify;dur=...` (ms): the whole
    * proxy, and resolving the session (a local verify, or a refresh).
    */
   readonly serverTiming?: boolean;
 }
-export type ActionResult<T> = {
+type ActionResult<T> = {
   readonly ok: true;
   readonly data: T;
   readonly error: null;
@@ -64,7 +64,7 @@ export type ActionResult<T> = {
   readonly data: null;
   readonly error: DbError;
 };
-export interface ActionOptions<S extends StandardSchemaV1 | undefined> extends GuardOptions {
+interface ActionOptions<S extends StandardSchemaV1 | undefined> extends GuardOptions {
   /** Validates the input (plain object or `FormData`) with any Standard Schema. */
   readonly input?: S;
 }
@@ -76,29 +76,30 @@ type Unwrapped<T> = T extends {
 } | {
   readonly ok: false;
 } ? D : T;
-export interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown> extends BetterServer<M, F, E, C> {
+interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown, U = unknown> extends BetterServer<M, F, E, C, U> {
   /** `proxy.ts`: refreshes sessions for page loads and server actions. */
-  proxy(request: NextRequest, options?: ProxyOptions<C>): Promise<Response>;
+  proxy(request: NextRequest, options?: ProxyOptions<C, U>): Promise<Response>;
   /** Server Components and actions: the caller's context, memoized per request. */
-  server(): Promise<ServerContext<M, F, E, C>>;
+  server(): Promise<ServerContext<M, F, E, C, U>>;
   /**
    * The verified caller as serializable data (no token, no clients), memoized
    * per request. Wrap it in a `'use cache: private'` function with Cache
    * Components and pass the promise to `<SessionProvider>`.
    */
-  session(): Promise<AuthSession<C>>;
+  session(): Promise<AuthSession<C, U>>;
   /**
    * The context for a session and its token, without reading the request.
    * The token is verified again (memoized, no network call); a token for
    * another user than `session` gives an `invalid` context.
    */
-  serverFor(session: AuthSession<C>, options: {
+  serverFor(session: AuthSession<C, U>, options: {
     readonly token: string | null;
-  }): Promise<ServerContext<M, F, E, C>>;
+  }): Promise<ServerContext<M, F, E, C, U>>;
   /**
    * First statement of an app-authored `'use cache: private'` function: sets
-   * `cacheLife` from the session's expiry (`sessionStale`), tags the entry
-   * `bs:session:<user id>` and returns the caller's context plus `session`.
+   * `cacheLife` from the session's expiry (`sessionStale`, capped by
+   * `life.stale`), tags the entry `bs:session:<user id>` plus `tags`, and
+   * returns the caller's context plus `session`.
    *
    * ```ts
    * async function getCustomers() {
@@ -108,9 +109,14 @@ export interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C =
    * }
    * ```
    */
-  cached(options?: CachedOptions): Promise<CachedContext<M, F, E, C>>;
-  /** Drops every `next.cached()` entry of a user, e.g. after a role change. */
-  invalidateSession(userId: string): void;
+  cached(options?: CachedOptions): Promise<CachedContext<M, F, E, C, U>>;
+  /**
+   * Drops every `next.cached()` entry of a user, e.g. after a role change,
+   * and the entries tagged with `tags` (such as PermDock's `snapshotTag(userId)`).
+   */
+  invalidateSession(userId: string, options?: {
+    readonly tags?: readonly string[];
+  }): void;
   /**
    * Counts on the server and returns a serializable seed for
    * `useLiveCount(seed)`, so the badge renders with a number and the client
@@ -120,13 +126,13 @@ export interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C =
    */
   liveCount<T extends Extract<keyof M, string>>(spec: QuerySpec<T, "count", number>, db?: CountRunner): Promise<LiveCountSeed<T>>;
   /** Route handler with auth, Result unwrapping and Problem Details errors. */
-  route<P = Record<string, string | string[]>>(handler: (request: NextRequest, ctx: ServerContext<M, F, E, C> & {
+  route<P = Record<string, string | string[]>>(handler: (request: NextRequest, ctx: ServerContext<M, F, E, C, U> & {
     readonly params: P;
   }) => unknown, options?: GuardOptions): (request: NextRequest, segment: {
     readonly params: Promise<P>;
   }) => Promise<Response>;
   /** Server action returning a serializable `ActionResult`. */
-  action<S extends StandardSchemaV1 | undefined, T>(options: ActionOptions<S>, fn: (input: ActionParsed<S>, ctx: ServerContext<M, F, E, C>) => Promise<T> | T): (input: ActionInput<S>) => Promise<ActionResult<Unwrapped<Awaited<T>>>>;
+  action<S extends StandardSchemaV1 | undefined, T>(options: ActionOptions<S>, fn: (input: ActionParsed<S>, ctx: ServerContext<M, F, E, C, U>) => Promise<T> | T): (input: ActionInput<S>) => Promise<ActionResult<Unwrapped<Awaited<T>>>>;
   /** Tags the current `"use cache"` scope with a table (and row) tag. */
   cacheTag(table: Extract<keyof M, string>, id?: string | number): void;
   /**
@@ -141,7 +147,7 @@ export interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C =
    */
   debugRoute(): (request: Request) => Promise<Response>;
 }
-export interface SessionStaleOptions {
+interface SessionStaleOptions {
   /** Below this, the result would not be prefetched anyway. Defaults to 30. */
   readonly min?: number;
   /** 300 (5 minutes) joins the route's App Shell. Defaults to 300. */
@@ -152,15 +158,22 @@ export interface SessionStaleOptions {
  * the token's expiry, and at least `min`.
  */
 export declare function sessionStale(session: AuthSession, options?: SessionStaleOptions, now?: number): number;
-export interface CachedOptions {
-  /** `cacheLife` for the entry. `stale` comes from `sessionStale`. */
+interface CachedOptions {
+  /**
+   * `cacheLife` for the entry. `stale` is `sessionStale`, and never more than
+   * `stale` when it is set: pass PermDock's `cacheLifeFor(snapshot)` so the
+   * entry goes stale with the snapshot too.
+   */
   readonly life?: SessionStaleOptions & {
+    readonly stale?: number;
     readonly revalidate?: number;
     readonly expire?: number;
   };
+  /** More `cacheTag`s for the entry, e.g. `snapshotTag(sub)` or `org:<id>`. */
+  readonly tags?: readonly string[];
 }
-export type CachedContext<M extends AnyModels, F extends AnyFunctions, E, C = unknown> = ServerContext<M, F, E, C> & {
-  readonly session: AuthSession<C>;
+type CachedContext<M extends AnyModels, F extends AnyFunctions, E, C = unknown, U = unknown> = ServerContext<M, F, E, C, U> & {
+  readonly session: AuthSession<C, U>;
 };
 /** The tag `next.cached()` puts on a user's entries. */
 export declare function sessionTag(userId: string): string;
@@ -172,7 +185,7 @@ export declare function tagFor(table: string, id?: string | number): string;
  * `cacheTags: false`.
  */
 export declare function nextCache(): CacheAdapter;
-export interface RequireAalOptions {
+interface RequireAalOptions {
   /**
    * Page that enrolls or challenges a second factor. Signed-in users below
    * the level are redirected there with `?next=<path>`; without it they get
@@ -205,6 +218,6 @@ export declare function shouldRefresh(request: Request): boolean;
  * export const next = createNext(sb);
  * ```
  */
-export declare function createNext<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown>(sb: BetterSupabase<M, D, F, E, C>, options?: NextOptions): BetterNext<M, F, E, C>;
+export declare function createNext<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, U = unknown>(sb: BetterSupabase<M, D, F, E, C, U>, options?: NextOptions): BetterNext<M, F, E, C, U>;
 //#endregion
-export { type Aal, type AmrEntry, type AuthKind, type AuthSession, type DbBudget, type DbStats, type EntitlementKey, type GuardOptions, type Impersonator, hasEntitlement, toSession };
+export { type Aal, type ActionOptions, type ActionResult, type AmrEntry, type AuthKind, type AuthSession, type BetterNext, type CachedContext, type CachedOptions, type DbBudget, type DbStats, type EntitlementKey, type GuardOptions, type Impersonator, type MembershipClaim, type NextDebugOptions, type NextOptions, type ProxyOptions, type RequireAalOptions, type SessionStaleOptions, hasEntitlement, toSession };

package/dist/next/index.js

@@ -1,12 +1,13 @@
 import { n as dbError } from "../errors-Bl3rkOzo.js";
-import { n as StatsRecorder, t as EMPTY_STATS } from "../stats-3iy8u3_P.js";
-import { o as isReadSet } from "../read-set-DhX2d04c.js";
+import { n as StatsRecorder, t as EMPTY_STATS } from "../stats-D78UQ8Yu.js";
+import { o as isReadSet } from "../read-set-D0qBcboM.js";
 import { t as validate } from "../standard-FUi3Z3-7.js";
-import { a as problemResponse } from "../problem-DPu6Fh-t.js";
-import { t as hasEntitlement } from "../entitlements-BC_khwRy.js";
-import { a as settle, c as withExtra, d as primaryCookie, i as respond, n as guard, o as createServer, s as extendServer, t as defaultExpose, u as PRIMARY_COOKIE } from "../respond-4-dhoV7x.js";
-import { r as checkAal } from "../mfa-CpogP66z.js";
-import { t as toSession } from "../view-B6F9QbG-.js";
+import { a as problemResponse } from "../problem-CGt1ADix.js";
+import { t as isList } from "../guards-BnzDvFrz.js";
+import { t as hasEntitlement } from "../entitlements-CTEBm7IB.js";
+import { a as settle, c as withExtra, d as primaryCookie, i as respond, n as guard, o as createServer, s as extendServer, t as defaultExpose, u as PRIMARY_COOKIE } from "../respond-C44EZAJo.js";
+import { r as checkAal } from "../mfa-BxoR1RkN.js";
+import { t as toSession } from "../view-wZ-9qIUz.js";
 import { cache } from "react";
 import { cacheLife, cacheTag, revalidateTag, updateTag } from "next/cache.js";
 import { cookies, headers } from "next/headers.js";
@@ -42,7 +43,9 @@ var StatsCollector = class {
 		this.#prune();
 		const entry = {
 			created: Date.now(),
-			recorder: new CollectedRecorder(() => this.#schedule(id))
+			recorder: new CollectedRecorder(() => {
+				this.#schedule(id);
+			})
 		};
 		this.#entries.set(id, entry);
 		return entry.recorder;
@@ -139,7 +142,7 @@ function serverTimingValue(metrics) {
 	return Object.entries(metrics).map(([name, ms]) => `${name};dur=${ms.toFixed(1)}`).join(", ");
 }
 //#endregion
-//#region src/next/index.ts
+//#region src/next/create.ts
 /** Response header with the URL of the request's totals on `next.debugRoute()`. */
 const STATS_URL_HEADER = "x-bs-stats";
 /**
@@ -207,10 +210,10 @@ function formDataObject(form) {
 function requireAal(level, options = {}) {
 	return (auth, request) => {
 		const { pathname, search } = request.nextUrl;
-		if (options.redirect !== void 0 && pathname === options.redirect) return void 0;
-		if (options.match && !options.match(pathname)) return void 0;
+		if (options.redirect !== void 0 && pathname === options.redirect) return;
+		if (options.match && !options.match(pathname)) return;
 		const denied = checkAal(auth, level);
-		if (!denied) return void 0;
+		if (!denied) return;
 		if (options.redirect === void 0) return problemResponse(denied);
 		const target = new URL(options.redirect, request.url);
 		target.searchParams.set("next", `${pathname}${search}`);
@@ -243,8 +246,8 @@ function createNext(sb, options = {}) {
 	const debug = options.debug;
 	const statsHeader = debug?.header ?? "x-bs-db-calls";
 	const statsRoute = debug?.route ?? "/api/bs-stats";
-	const development = typeof process !== "undefined" && process.env["NODE_ENV"] === "development";
-	const collector = debug && (debug.enabled ?? development) ? sharedCollector({
+	const development = process.env["NODE_ENV"] === "development";
+	const collector = debug?.enabled ? sharedCollector({
 		logger: sb.events.logger,
 		warn: development,
 		...debug.budget ? { budget: debug.budget } : {}
@@ -283,16 +286,19 @@ function createNext(sb, options = {}) {
 		async cached(cachedOptions = {}) {
 			const [view, ctx] = await Promise.all([session(), server()]);
 			const life = cachedOptions.life;
+			const stale = sessionStale(view, life);
 			cacheLife({
-				stale: sessionStale(view, life),
+				stale: life?.stale === void 0 ? stale : Math.min(stale, life.stale),
 				...life?.revalidate === void 0 ? {} : { revalidate: life.revalidate },
 				...life?.expire === void 0 ? {} : { expire: life.expire }
 			});
-			if (view.kind === "user") cacheTag(sessionTag(view.user.id));
+			const tags = [...view.kind === "user" ? [sessionTag(view.user.id)] : [], ...cachedOptions.tags ?? []];
+			if (tags.length > 0) cacheTag(...tags);
 			return withExtra(ctx, { session: view });
 		},
-		invalidateSession(userId) {
+		invalidateSession(userId, invalidateOptions = {}) {
 			invalidate(sessionTag(userId));
+			for (const tag of invalidateOptions.tags ?? []) invalidate(tag);
 		},
 		async liveCount(spec, db) {
 			const result = await (db ?? (await server()).db).$run(spec);
@@ -336,7 +342,7 @@ function createNext(sb, options = {}) {
 		route(handler, guardOptions = {}) {
 			return async (request, segment) => {
 				const ctx = await base.context(request, statsFor(request));
-				const denied = guard(ctx.auth, guardOptions.allow, guardOptions.aal);
+				const denied = guard(ctx.auth, guardOptions.allow, guardOptions.aal, guardOptions.scopes);
 				const instance = request.nextUrl.pathname;
 				if (denied) return problemResponse(denied, {
 					instance,
@@ -357,23 +363,23 @@ function createNext(sb, options = {}) {
 			};
 		},
 		debugRoute() {
-			return async (request) => {
+			return (request) => {
 				const id = new URL(request.url).searchParams.get("id");
-				if (!collector || !id) return Response.json({ error: collector ? "missing ?id=" : "debug is off" }, {
+				if (!collector || !id) return Promise.resolve(Response.json({ error: collector ? "missing ?id=" : "debug is off" }, {
 					status: 404,
 					headers: { "cache-control": "no-store" }
-				});
+				}));
 				const stats = collector.get(id) ?? EMPTY_STATS;
-				return Response.json(stats, { headers: {
+				return Promise.resolve(Response.json(stats, { headers: {
 					[statsHeader]: formatStats(stats),
 					"cache-control": "no-store"
-				} });
+				} }));
 			};
 		},
 		action(actionOptions, fn) {
 			return async (input) => {
 				const ctx = await server();
-				const denied = guard(ctx.auth, actionOptions.allow, actionOptions.aal);
+				const denied = guard(ctx.auth, actionOptions.allow, actionOptions.aal, actionOptions.scopes);
 				if (denied) return {
 					ok: false,
 					data: null,
@@ -411,7 +417,7 @@ function createNext(sb, options = {}) {
 			cacheTag(tagFor(table), ...id === void 0 ? [] : [tagFor(table, id)]);
 		},
 		cacheTags(target) {
-			const specs = isReadSet(target) ? Object.values(target.specs) : Array.isArray(target) ? target : [target];
+			const specs = isReadSet(target) ? Object.values(target.specs) : isList(target) ? target : [target];
 			const tags = /* @__PURE__ */ new Set();
 			for (const spec of specs) {
 				for (const table of sb.tablesOf(spec)) tags.add(tagFor(table));

package/dist/openapi/index.d.ts

@@ -1,2 +1,2 @@
-import { a as ResourceOptions, i as ResourceOperation, n as OpenApiOptions, o as createOpenApi, r as PROBLEM_SCHEMA, t as OpenApiDocument } from "../index-DRid0qIv.js";
+import { a as ResourceOptions, i as ResourceOperation, n as OpenApiOptions, o as createOpenApi, r as PROBLEM_SCHEMA, t as OpenApiDocument } from "../index-qriRM9cZ.js";
 export { OpenApiDocument, OpenApiOptions, PROBLEM_SCHEMA, ResourceOperation, ResourceOptions, createOpenApi };

package/dist/openapi/index.js

@@ -1,6 +1,6 @@
-import { n as PROBLEM_TYPE_BASE, t as PROBLEM_CONTENT_TYPE } from "../problem-DPu6Fh-t.js";
-import { t as SPEC_PINS } from "../spec-pins-t6sPaHvl.js";
-import { t as buildJsonSchema } from "../json-schema-BbwO2mZg.js";
+import { n as PROBLEM_TYPE_BASE, t as PROBLEM_CONTENT_TYPE } from "../problem-CGt1ADix.js";
+import { t as SPEC_PINS } from "../spec-pins-C3oc-Tdp.js";
+import { t as buildJsonSchema } from "../json-schema--aOXAGfU.js";
 //#region src/openapi/index.ts
 /** JSON Schema for RFC 9457 Problem Details as better-supabase sends them. */
 const PROBLEM_SCHEMA = {
@@ -81,7 +81,7 @@ const ERRORS = [
 		"Validation or a check constraint failed."
 	]
 ];
-const pascal = (value) => value.replace(/(^|[_-])(\w)/g, (_, _sep, char) => char.toUpperCase());
+const pascal = (value) => value.replaceAll(/(^|[_-])(\w)/g, (_, _sep, char) => char.toUpperCase());
 const ref = (name) => ({ $ref: `#/components/schemas/${name}` });
 const response = (name) => ({ $ref: `#/components/responses/${name}` });
 function errorResponses(codes) {
@@ -95,8 +95,14 @@ function jsonBody(schema, description) {
 		content: { "application/json": { schema } }
 	};
 }
-function pageParameters() {
-	return [{
+function pageParameters(cursor, maxPageSize) {
+	return [cursor ? {
+		name: "after",
+		in: "query",
+		required: false,
+		description: "`nextCursor` of the previous page. Leave it out for the first page.",
+		schema: { type: "string" }
+	} : {
 		name: "page",
 		in: "query",
 		required: false,
@@ -114,11 +120,53 @@ function pageParameters() {
 		schema: {
 			type: "integer",
 			minimum: 1,
-			maximum: 200,
+			maximum: maxPageSize,
 			default: 50
 		}
 	}];
 }
+function pageSchema(row, cursor) {
+	const items = {
+		type: "array",
+		items: row
+	};
+	return cursor ? {
+		type: "object",
+		required: [
+			"items",
+			"nextCursor",
+			"hasMore"
+		],
+		properties: {
+			items,
+			nextCursor: { type: ["string", "null"] },
+			hasMore: { type: "boolean" }
+		}
+	} : {
+		type: "object",
+		required: ["items", "page"],
+		properties: {
+			items,
+			page: {
+				type: "object",
+				required: [
+					"number",
+					"size",
+					"total",
+					"pages",
+					"hasMore"
+				],
+				properties: {
+					number: { type: "integer" },
+					size: { type: "integer" },
+					total: { type: ["integer", "null"] },
+					pages: { type: ["integer", "null"] },
+					hasMore: { type: "boolean" }
+				}
+			}
+		}
+	};
+}
 /**
 * An OpenAPI 3.1 document for REST resources over your tables, with schemas
 * from the generated metadata, list-query parameters, Supabase security
@@ -167,33 +215,8 @@ function createOpenApi(sb, options) {
 			const schema = defs[`${key}${variant}`];
 			if (schema) schemas[`${name}${variant}`] = schema;
 		}
-		schemas[`${name}Page`] = {
-			type: "object",
-			required: ["items", "page"],
-			properties: {
-				items: {
-					type: "array",
-					items: ref(`${name}Row`)
-				},
-				page: {
-					type: "object",
-					required: [
-						"number",
-						"size",
-						"total",
-						"pages",
-						"hasMore"
-					],
-					properties: {
-						number: { type: "integer" },
-						size: { type: "integer" },
-						total: { type: ["integer", "null"] },
-						pages: { type: ["integer", "null"] },
-						hasMore: { type: "boolean" }
-					}
-				}
-			}
-		};
+		const cursor = (resource.list ? resource.list.pagination : resource.pagination) === "cursor";
+		schemas[`${name}Page`] = pageSchema(ref(`${name}Row`), cursor);
 		const collection = `${base}${resource.path ?? `/${key}`}`;
 		const keyColumn = table.primaryKey.length === 1 ? table.primaryKey[0] : void 0;
 		const idSchema = keyColumn ? (defs[`${key}Row`]?.["properties"])?.[keyColumn] ?? { type: "string" } : void 0;
@@ -215,7 +238,7 @@ function createOpenApi(sb, options) {
 		for (const operation of operations) switch (operation) {
 			case "list":
 				(paths[collection] ??= {})["get"] = op("list", `List ${key}`, {
-					parameters: resource.list?.openapi ?? pageParameters(),
+					parameters: resource.list?.openapi ?? pageParameters(cursor, resource.maxPageSize ?? 200),
 					responses: {
 						"200": jsonBody(ref(`${name}Page`), `A page of ${key}.`),
 						...errorResponses([

package/dist/orpc/index.d.ts

@@ -1,9 +1,9 @@
-import { n as AnyModels, t as AnyFunctions } from "../types-C2fslP1z.js";
-import { o as Result, p as DbError } from "../result-CTkCZ6JA.js";
-import { t as BetterSupabase } from "../define-CTfWw-SS.js";
-import { r as AuthState } from "../resolve-DW8h9NPm.js";
-import { d as ServerContext, f as ServerOptions, l as BetterServer, n as GuardOptions } from "../respond-PoTpy5DT.js";
-import { r as ProblemDetails } from "../problem-DlgB0lYl.js";
+import { n as AnyModels, t as AnyFunctions } from "../types-DONv9SHN.js";
+import { o as Result, p as DbError } from "../result-c2OYgCV2.js";
+import { t as BetterSupabase } from "../define-DUbydmJa.js";
+import { r as AuthState } from "../resolve-BRciX2jK.js";
+import { d as ServerContext, f as ServerOptions, l as BetterServer, n as GuardOptions } from "../respond-DAkPIdTH.js";
+import { r as ProblemDetails } from "../problem-Z2RTQjZD.js";
 import { DecoratedMiddleware, ORPCError } from "@orpc/server";
 //#region src/orpc/index.d.ts
 /** Initial context: pass `{ context: { request } }` to the oRPC handler. */

package/dist/orpc/index.js

@@ -1,6 +1,6 @@
 import { r as dbErrorOf } from "../errors-Bl3rkOzo.js";
-import { o as toProblem } from "../problem-DPu6Fh-t.js";
-import { a as settle, n as guard, o as createServer, s as extendServer, t as defaultExpose } from "../respond-4-dhoV7x.js";
+import { o as toProblem } from "../problem-CGt1ADix.js";
+import { a as settle, n as guard, o as createServer, s as extendServer, t as defaultExpose } from "../respond-C44EZAJo.js";
 import { COMMON_ERROR_STATUS_MAP, ORPCError, os } from "@orpc/server";
 //#region src/orpc/index.ts
 const CODES = new Map(Object.entries(COMMON_ERROR_STATUS_MAP).map(([code, status]) => [status, code]));
@@ -24,7 +24,7 @@ function createOrpc(sb, options = {}) {
 		middleware(middlewareOptions = {}) {
 			return os.$context().middleware(async ({ context, next }) => {
 				const ctx = await server.context(context.request, { refresh: middlewareOptions.refresh ?? false });
-				const denied = guard(ctx.auth, middlewareOptions.allow, middlewareOptions.aal);
+				const denied = guard(ctx.auth, middlewareOptions.allow, middlewareOptions.aal, middlewareOptions.scopes);
 				if (denied) throw toORPCError(denied);
 				try {
 					return await next({ context: {

package/dist/otel/index.d.ts

@@ -1,6 +1,6 @@
-import { a as EventHub } from "../events-2OJsVG_d.js";
-import { f as Plugin } from "../plugin-HvGqCurB.js";
-import { t as SPEC_PINS } from "../spec-pins-CJPVghHy.js";
+import { a as EventHub } from "../events-Do8jXh4D.js";
+import { f as Plugin } from "../plugin-DVRB8qNE.js";
+import { t as SPEC_PINS } from "../spec-pins-CqorWDnO.js";
 import { Attributes, Meter, Tracer } from "@opentelemetry/api";
 //#region src/otel/index.d.ts
 export declare const INSTRUMENTATION_NAME = "better-supabase";

package/dist/otel/index.js

@@ -1,6 +1,6 @@
 import { n as definePlugin } from "../plugin-BqR6wKMB.js";
-import { t as SPEC_PINS } from "../spec-pins-t6sPaHvl.js";
-import "../version-Cqq1m3UY.js";
+import { t as SPEC_PINS } from "../spec-pins-C3oc-Tdp.js";
+import "../version-BfpG2gks.js";
 import { SpanKind, SpanStatusCode, context, metrics, propagation, trace } from "@opentelemetry/api";
 //#region src/otel/index.ts
 const INSTRUMENTATION_NAME = "better-supabase";
@@ -157,7 +157,9 @@ function traceAuth(sb, options = {}) {
 function tracedFetch(base = fetch) {
 	return (input, init) => {
 		const headers = new Headers(init?.headers ?? (input instanceof Request ? input.headers : void 0));
-		propagation.inject(context.active(), headers, { set: (carrier, key, value) => carrier.set(key, value) });
+		propagation.inject(context.active(), headers, { set: (carrier, key, value) => {
+			carrier.set(key, value);
+		} });
 		return base(input, {
 			...init,
 			headers

package/dist/{template-BeOGnynM.js → permdock-sql-Bta_G0v-.js}

@@ -21,7 +21,7 @@ function parseSegment(segment) {
 	});
 	return parts;
 }
-const escapeRegex = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+const escapeRegex = (text) => text.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
 function parseTemplate(source, separator, validate) {
 	const segments = source.split(separator).map(parseSegment);
 	const params = [];
@@ -87,7 +87,36 @@ function sqlIdent(value) {
 }
 /** Postgres identifier-safe name part: `customer-logos` → `customer_logos`. */
 function slug(value) {
-	return value.replace(/[^A-Za-z0-9]+/g, "_").replace(/^_|_$/g, "").toLowerCase();
+	return value.replaceAll(/[^A-Za-z0-9]+/g, "_").replaceAll(/^_|_$/g, "").toLowerCase();
 }
 //#endregion
-export { sqlString as i, slug as n, sqlIdent as r, parseTemplate as t };
+//#region src/core/permdock-sql.ts
+const SCOPE = /^[a-z_][a-z0-9_]*$/;
+/** PermDock splits a key with row conditions into `key#1`, `key#2`, ...: those need its own policies. */
+const SPLIT_KEY = /#\d+$/;
+/**
+* The SQL condition for one PermDock permission key. `id` is the text
+* expression holding the scope id; it is compared as text, so a malformed
+* path never raises a cast error.
+*
+* The helpers check role and scope, not a permission's row conditions, so
+* the condition is only correct for permissions whose grants have none
+* beyond the scope. `#n` keys are refused, and so are keys the catalog marks
+* with `rowConditions: true` when one is passed.
+*/
+function permdockCheck(where, target, key, id, catalog) {
+	if (key === "") throw new TypeError(`${where}: a PermDock permission key is empty`);
+	if (SPLIT_KEY.test(key)) throw new TypeError(`${where}: "${key}" is one part of a permission PermDock splits by row condition. Use PermDock's generated policies for it.`);
+	if (catalog?.permissions.some((permission) => permission.key === key && permission.rowConditions === true)) throw new TypeError(`${where}: "${key}" has row conditions in PermDock's catalog (rowConditions: true), which the SQL helpers don't check. Use PermDock's generated policies for it.`);
+	const schema = sqlIdent(target.schema ?? "public");
+	if (target.scope === "global") return `(select ${schema}.permdock_has(${sqlString(key)}))`;
+	if (!SCOPE.test(target.scope)) throw new TypeError(`${where}: invalid PermDock scope "${target.scope}"`);
+	if (id === void 0) throw new TypeError(`${where}: scope "${target.scope}" needs a segment`);
+	return `${id} in (select t.id::text from ${schema}.${sqlIdent(`permitted_${target.scope}_ids`)}(${sqlString(key)}) as t(id))`;
+}
+/** The keys a bucket or topic PermDock policy names. */
+function permdockKeys(policy) {
+	return Object.values(policy.permdock).filter((key) => typeof key === "string");
+}
+//#endregion
+export { sqlIdent as a, slug as i, permdockKeys as n, sqlString as o, parseTemplate as r, permdockCheck as t };

package/dist/permdock-sql-DImJULY-.d.ts

@@ -0,0 +1,17 @@
+//#region src/core/permdock-sql.d.ts
+/**
+ * The part of PermDock's `permissions.catalog.json` the Storage and Realtime
+ * builders read: `import catalog from './permissions.catalog.json'`.
+ */
+interface PermdockCatalog {
+  readonly permissions: readonly {
+    readonly key: string;
+    readonly rowConditions?: boolean;
+  }[];
+}
+/** The keys a bucket or topic PermDock policy names. */
+declare function permdockKeys(policy: {
+  readonly permdock: object;
+}): string[];
+//#endregion
+export { permdockKeys as n, PermdockCatalog as t };

package/dist/{plugin-HvGqCurB.d.ts → plugin-DVRB8qNE.d.ts}

@@ -1,6 +1,7 @@
-import { A as TableMeta, E as SchemaMeta, n as AnyModels } from "./types-C2fslP1z.js";
-import { g as Operation, h as MutationOp, r as Executor } from "./executor-Bazhgsgq.js";
-import { v as ErrorMapper } from "./result-CTkCZ6JA.js";
+/// <reference lib="esnext.temporal" />
+import { A as SchemaMeta, P as TableMeta, n as AnyModels } from "./types-DONv9SHN.js";
+import { g as Operation, h as MutationOp, r as Executor } from "./executor-DynmIWhq.js";
+import { v as ErrorMapper } from "./result-c2OYgCV2.js";
 //#region src/core/plugin.d.ts
 /** Who is making the request. */
 interface Actor {
@@ -28,7 +29,7 @@ interface HookArgs {
   readonly schema: SchemaMeta;
   readonly context: RequestContext;
   readonly options: CallOptions;
-  readonly now: () => Date;
+  readonly now: () => Temporal.Instant;
 }
 type MutationKind = "insert" | "upsert" | "update" | "delete";
 interface MutationEvent {

package/dist/plugins/actor/index.d.ts

@@ -1,4 +1,4 @@
-import { f as Plugin, h as RequestContext } from "../../plugin-HvGqCurB.js";
+import { f as Plugin, h as RequestContext } from "../../plugin-DVRB8qNE.js";
 //#region src/plugins/actor/index.d.ts
 export interface ActorOptions {
   /** Custom actor id resolution. Defaults to `context.actor.id` for users and services. */