better-supabase 0.15.1 → 0.16.0

package/dist/svelte/index.d.ts

@@ -1,13 +1,13 @@
 import { b as DbError } from "../result-DZeA5KS6.js";
 import { Ct as Events, D as BlockEventPattern, T as BlockEvent, bt as EventMap, k as BlockEventsMatching } from "../events-vcqenSYU.js";
-import { pt as QuerySpec } from "../define-DFBnQyYg.js";
-import { $ as TemplateValues } from "../bucket-CiNi8sIw.js";
-import { g as TopicHandlers, m as Topic, p as SubscriptionStatus, r as PresenceMember, t as EventSchemas } from "../topic-DNFEFGKI.js";
-import { t as AuthSnapshot } from "../bind-h5jre2K0.js";
+import { pt as QuerySpec } from "../define-C5AcEkEJ.js";
+import { tt as TemplateValues } from "../bucket-vc-QRrva.js";
+import { g as TopicHandlers, m as Topic, p as SubscriptionStatus, r as PresenceMember, t as EventSchemas } from "../topic-CZXHhZye.js";
+import { t as AuthSnapshot } from "../bind-JGCPGUJh.js";
 import { t as AuthSession } from "../view-DyFdMCqg.js";
-import { n as Controller } from "../controller-DyPPMFSw.js";
-import { C as LiveCountSource, D as ProfileOf, E as PresenceTopic, O as UseActionOptions, S as LiveCountHookOptions, T as PresenceHookOptions, _ as ActionResultOf, a as DataRows, b as ClaimsOf, c as DataWrites, d as BlockMutationState, f as BlockQueryActions, g as ActionInputOf, h as BlockRefetchOn, i as DataRow, l as BlockEventSource, m as BlockQueryState, n as DataId, o as DataSource, p as BlockQueryOptions, r as DataListArgs, s as DataState, t as fieldErrorsOf, u as BlockMutationActions, v as ActionState, w as LiveQueryHookOptions, x as ClientLike, y as BroadcastOptions } from "../field-errors-DYtg1mwv.js";
-import { n as BlockOptions } from "../block-env-BrfRvPrj.js";
+import { n as Controller } from "../controller-BW-5Opig.js";
+import { C as LiveCountSource, D as ProfileOf, E as PresenceTopic, O as UseActionOptions, S as LiveCountHookOptions, T as PresenceHookOptions, _ as ActionResultOf, a as DataRows, b as ClaimsOf, c as DataWrites, d as BlockMutationState, f as BlockQueryActions, g as ActionInputOf, h as BlockRefetchOn, i as DataRow, l as BlockEventSource, m as BlockQueryState, n as DataId, o as DataSource, p as BlockQueryOptions, r as DataListArgs, s as DataState, t as fieldErrorsOf, u as BlockMutationActions, v as ActionState, w as LiveQueryHookOptions, x as ClientLike, y as BroadcastOptions } from "../field-errors-Dt86dCKk.js";
+import { n as BlockOptions } from "../block-env-y65GF_px.js";
 import { n as BlockDataOf, r as BlockMethodName, t as BlockArgsOf } from "../block-method-CiVa2G-J.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { QueryClient } from "@tanstack/query-core";

package/dist/svelte/index.js

@@ -1,5 +1,5 @@
 import { t as clearOnUserChange } from "../user-change-DgWC6RRC.js";
-import { a as createActionRunner, c as liveKey, d as shownCount, f as startBroadcast, i as countSource, l as notJoined, m as startLiveQuery, n as assertInvalidateClient, o as joinPresence, p as startLiveCount, r as callerOf, s as keyed, t as NO_COUNT, u as plainCaller } from "../client-BAEbEA7t.js";
+import { a as createActionRunner, c as liveKey, d as shownCount, f as startBroadcast, i as countSource, l as notJoined, m as startLiveQuery, n as assertInvalidateClient, o as joinPresence, p as startLiveCount, r as callerOf, s as keyed, t as NO_COUNT, u as plainCaller } from "../client-C_mlji5R.js";
 import { c as listenToBlockEvents, d as fieldErrorsOf, i as dataTarget, l as blockEnv, n as createDataOne, o as createBlockMutation, s as createBlockQuery, t as createDataList, u as withEnv } from "../data-hooks-tgF1Ct0F.js";
 import { getContext, onDestroy, onMount, setContext } from "svelte";
 import { createSubscriber } from "svelte/reactivity";

package/dist/sveltekit/index.d.ts

@@ -1,12 +1,12 @@
 import { O as AnyFunctions, k as AnyModels } from "../types-DFdg_4yN.js";
 import { l as PermissionRef, t as AnyAuthorizer } from "../authorizer-B6X09otb.js";
-import { t as BetterSupabase } from "../define-DFBnQyYg.js";
-import { n as BetterServer } from "../server-types-7QPzW2bF.js";
+import { t as BetterSupabase } from "../define-C5AcEkEJ.js";
+import { n as BetterServer } from "../server-types-CK8mUIUT.js";
 import { a as AuthorizedContext, c as ResourceLoaderContext, i as AuthorizeOptions, l as Unwrapped, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-DOwKpSkA.js";
 import { t as RefusalRedirects } from "../refusal-CSntB_x8.js";
-import { n as FrameworkOptions, r as LocalsResource, t as FrameworkLocals } from "../framework-h5lP_5yj.js";
+import { n as FrameworkOptions, r as LocalsResource, t as FrameworkLocals } from "../framework-BGdZVyPL.js";
 import { t as Validated } from "../shared-CRRfQAKG.js";
-import { i as tagFor } from "../tags-BjHflcHF.js";
+import { i as tagFor } from "../tags-qvVk79pp.js";
 import { AnyEntry, Contributions } from "@supabase/middleware";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/bridges/sveltekit.d.ts

package/dist/{tags-BjHflcHF.d.ts → tags-qvVk79pp.d.ts}

@@ -1,4 +1,4 @@
-import { Qt as CacheTarget, Zt as CacheAdapter } from "./define-DFBnQyYg.js";
+import { Qt as CacheTarget, Zt as CacheAdapter } from "./define-C5AcEkEJ.js";
 //#region src/core/tags.d.ts
 interface TagOptions {
   /** The tenant the read is scoped to; `"*"` is every tenant's reads. */

package/dist/tanstack-db/index.d.ts

@@ -1,5 +1,5 @@
 import { O as AnyFunctions, k as AnyModels, ut as TableKey } from "../types-DFdg_4yN.js";
-import { t as BetterSupabase, v as Db } from "../define-DFBnQyYg.js";
+import { t as BetterSupabase, v as Db } from "../define-C5AcEkEJ.js";
 import { n as DataEngine } from "../data-engine-BWoz9lED.js";
 import { t as BetterQueryMeta } from "../invalidate-DMp4eqfF.js";
 import { QueryClient, SkipToken } from "@tanstack/query-core";

package/dist/tanstack-start/index.d.ts

@@ -1,10 +1,10 @@
 import { O as AnyFunctions, k as AnyModels } from "../types-DFdg_4yN.js";
 import { l as PermissionRef, t as AnyAuthorizer } from "../authorizer-B6X09otb.js";
-import { t as BetterSupabase } from "../define-DFBnQyYg.js";
-import { n as BetterServer } from "../server-types-7QPzW2bF.js";
+import { t as BetterSupabase } from "../define-C5AcEkEJ.js";
+import { n as BetterServer } from "../server-types-CK8mUIUT.js";
 import { a as AuthorizedContext, c as ResourceLoaderContext, i as AuthorizeOptions, l as Unwrapped, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-DOwKpSkA.js";
 import { t as RefusalRedirects } from "../refusal-CSntB_x8.js";
-import { n as FrameworkOptions, r as LocalsResource, t as FrameworkLocals } from "../framework-h5lP_5yj.js";
+import { n as FrameworkOptions, r as LocalsResource, t as FrameworkLocals } from "../framework-BGdZVyPL.js";
 import { t as Validated } from "../shared-CRRfQAKG.js";
 import { AnyEntry, Contributions } from "@supabase/middleware";
 import { StandardSchemaV1 } from "@standard-schema/spec";

package/dist/{tenant-DzFsg0Pc.d.ts → tenant-DOKIJI62.d.ts}

@@ -1,4 +1,4 @@
-import { t as AuthSnapshot } from "./bind-h5jre2K0.js";
+import { t as AuthSnapshot } from "./bind-JGCPGUJh.js";
 import { t as AuthSession } from "./view-DyFdMCqg.js";
 //#region src/auth/tenant.d.ts
 /**

package/dist/testing/index.d.ts

@@ -12,20 +12,21 @@ import { n as Embedder } from "../knowledge-F1IhRI4Q.js";
 import { a as AuthorizationProvider } from "../authorization-HZdJCaVm.js";
 import { o as StreamStore } from "../store-CpheI-lN.js";
 import { o as Authorizer } from "../authorizer-B6X09otb.js";
-import { J as DbStats, Zt as CacheAdapter, t as BetterSupabase, v as Db } from "../define-DFBnQyYg.js";
-import { X as StoragePath } from "../bucket-CiNi8sIw.js";
-import { B as SupportSessionStore, a as ServerContext, c as ServerOptions } from "../server-types-7QPzW2bF.js";
+import { J as DbStats, Zt as CacheAdapter, t as BetterSupabase, v as Db } from "../define-C5AcEkEJ.js";
+import { Q as StoragePath } from "../bucket-vc-QRrva.js";
+import { a as ServerContext, c as ServerOptions } from "../server-types-CK8mUIUT.js";
 import { n as Impersonator } from "../impersonation-YTa9dZUv.js";
-import { tn as AnyRecordBinding } from "../define-block-DvvcM54N.js";
+import { tn as AnyRecordBinding } from "../define-block-C1RHXz7L.js";
 import { n as Money } from "../money-BNRdJQzA.js";
 import { i as EventSink, t as CloudEvent } from "../cloud-event-CzZTJkXv.js";
 import { i as AuthorizationHooks } from "../authorization-hooks-D_pwXlBs.js";
 import { s as SqlClaims, t as BetterPostgres } from "../pool-CrtT4dg-.js";
+import { C as SupportSessionStore } from "../support-B4ZBVxt3.js";
 import { r as GuardOptions } from "../respond-Dn1_YhC1.js";
 import { l as Transcriber, s as NoteTaker, u as TranscriberInput } from "../recordings-BBSJt_YV.js";
-import { n as Controller } from "../controller-DyPPMFSw.js";
-import { c as AiTaskRunner, o as AiTaskRun, r as AiTask } from "../ai-schedules-D_Hz-ik5.js";
-import { Ht as GeneratorModel, Qt as ResolvedConfig, jt as Generator, zt as GeneratorInput } from "../context-TGX2eDS5.js";
+import { n as Controller } from "../controller-BW-5Opig.js";
+import { c as AiTaskRunner, o as AiTaskRun, r as AiTask } from "../ai-schedules-BmkARmQ9.js";
+import { Ht as GeneratorModel, Qt as ResolvedConfig, jt as Generator, zt as GeneratorInput } from "../context-8kb8m5uO.js";
 import { r as WebhookInput } from "../signatures-Dkx9OE8j.js";
 import { n as Payment, o as PaymentProvider } from "../payments-BYcN34Fp.js";
 import { t as NotificationChannel } from "../channel-BjvGO39m.js";

package/dist/{timeline-WrFMgd3U.d.ts → timeline-CvTuXYvn.d.ts}

@@ -1,9 +1,9 @@
 import { D as ValidationIssue, t as AsyncResult } from "./result-DZeA5KS6.js";
 import { $ as RecordRef } from "./types-DFdg_4yN.js";
 import { o as FilterField } from "./filter-query-BXLs72G9.js";
-import { cn as RecordBindingResult, hn as TimelineItem, in as RecordBindingData } from "./define-block-DvvcM54N.js";
-import { A as BindingBlocks, F as LoadBindingsOptions, M as BindingName, N as BindingOf, P as BindingSource, V as PermissionSet, _ as RecordTypeBlocks, g as RecordType, h as RecordCan } from "./index-BfkltrGJ.js";
-import { c as ListParseOptions, m as ListSearchParams } from "./list-query-BDVutLFr.js";
+import { cn as RecordBindingResult, hn as TimelineItem, in as RecordBindingData } from "./define-block-C1RHXz7L.js";
+import { A as BindingBlocks, F as LoadBindingsOptions, M as BindingName, N as BindingOf, P as BindingSource, V as PermissionSet, _ as RecordTypeBlocks, g as RecordType, h as RecordCan } from "./index-CcAmFNVi.js";
+import { c as ListParseOptions, m as ListSearchParams } from "./list-query-DYhgRTd5.js";
 //#region src/records/list.d.ts
 /**
  * How a binding fills a list column: `count` is how many rows it has (the

package/dist/{topic-DNFEFGKI.d.ts → topic-CZXHhZye.d.ts}

@@ -1,8 +1,8 @@
 import { D as ValidationIssue, b as DbError, t as AsyncResult } from "./result-DZeA5KS6.js";
 import { D as AccessTopicPolicy, O as AnyFunctions, it as Row, k as AnyModels, ut as TableKey } from "./types-DFdg_4yN.js";
 import { t as AuthorizationFunctions } from "./authorization-HZdJCaVm.js";
-import { t as BetterSupabase } from "./define-DFBnQyYg.js";
-import { $ as TemplateValues, Q as TemplateParams } from "./bucket-CiNi8sIw.js";
+import { t as BetterSupabase } from "./define-C5AcEkEJ.js";
+import { et as TemplateParams, tt as TemplateValues } from "./bucket-vc-QRrva.js";
 import { g as SubscriberPolicy, h as SubscriberEvent, i as AuthorizationHooks, m as Subscriber } from "./authorization-hooks-D_pwXlBs.js";
 import { t as RealtimeStatus } from "./realtime-status-BhNkb-Ow.js";
 import { RealtimeChannel, SupabaseClient } from "@supabase/supabase-js";

package/dist/{verify-CMou8dWZ.d.ts → verify-CjvNLY7N.d.ts}

@@ -1,7 +1,7 @@
 /// <reference lib="esnext.temporal" />
 import { f as Result } from "./result-DZeA5KS6.js";
 import { O as AnyFunctions, it as Row, k as AnyModels, ut as TableKey } from "./types-DFdg_4yN.js";
-import { t as BetterSupabase } from "./define-DFBnQyYg.js";
+import { t as BetterSupabase } from "./define-C5AcEkEJ.js";
 import { n as VerifyOptions, r as WebhookInput, t as VerifiedWebhook } from "./signatures-Dkx9OE8j.js";
 //#region src/blocks/webhooks/verify.d.ts
 /** The `Stripe-Signature` header for `body`, for tests and local replays. */

package/dist/vue/index.d.ts

@@ -1,13 +1,13 @@
 import { b as DbError } from "../result-DZeA5KS6.js";
 import { Ct as Events, D as BlockEventPattern, T as BlockEvent, bt as EventMap, k as BlockEventsMatching } from "../events-vcqenSYU.js";
-import { pt as QuerySpec } from "../define-DFBnQyYg.js";
-import { $ as TemplateValues } from "../bucket-CiNi8sIw.js";
-import { g as TopicHandlers, m as Topic, p as SubscriptionStatus, r as PresenceMember, t as EventSchemas } from "../topic-DNFEFGKI.js";
-import { t as AuthSnapshot } from "../bind-h5jre2K0.js";
+import { pt as QuerySpec } from "../define-C5AcEkEJ.js";
+import { tt as TemplateValues } from "../bucket-vc-QRrva.js";
+import { g as TopicHandlers, m as Topic, p as SubscriptionStatus, r as PresenceMember, t as EventSchemas } from "../topic-CZXHhZye.js";
+import { t as AuthSnapshot } from "../bind-JGCPGUJh.js";
 import { t as AuthSession } from "../view-DyFdMCqg.js";
-import { n as Controller } from "../controller-DyPPMFSw.js";
-import { C as LiveCountSource, D as ProfileOf, E as PresenceTopic, O as UseActionOptions, S as LiveCountHookOptions, T as PresenceHookOptions, _ as ActionResultOf, a as DataRows, b as ClaimsOf, c as DataWrites, d as BlockMutationState, f as BlockQueryActions, g as ActionInputOf, h as BlockRefetchOn, i as DataRow, l as BlockEventSource, m as BlockQueryState, n as DataId, o as DataSource, p as BlockQueryOptions, r as DataListArgs, s as DataState, t as fieldErrorsOf, u as BlockMutationActions, v as ActionState, w as LiveQueryHookOptions, x as ClientLike, y as BroadcastOptions } from "../field-errors-DYtg1mwv.js";
-import { n as BlockOptions } from "../block-env-BrfRvPrj.js";
+import { n as Controller } from "../controller-BW-5Opig.js";
+import { C as LiveCountSource, D as ProfileOf, E as PresenceTopic, O as UseActionOptions, S as LiveCountHookOptions, T as PresenceHookOptions, _ as ActionResultOf, a as DataRows, b as ClaimsOf, c as DataWrites, d as BlockMutationState, f as BlockQueryActions, g as ActionInputOf, h as BlockRefetchOn, i as DataRow, l as BlockEventSource, m as BlockQueryState, n as DataId, o as DataSource, p as BlockQueryOptions, r as DataListArgs, s as DataState, t as fieldErrorsOf, u as BlockMutationActions, v as ActionState, w as LiveQueryHookOptions, x as ClientLike, y as BroadcastOptions } from "../field-errors-Dt86dCKk.js";
+import { n as BlockOptions } from "../block-env-y65GF_px.js";
 import { n as BlockDataOf, r as BlockMethodName, t as BlockArgsOf } from "../block-method-CiVa2G-J.js";
 import { t as SupportView } from "../support-view-BYOgwXsJ.js";
 import { SupabaseClient } from "@supabase/supabase-js";

package/dist/vue/index.js

@@ -1,5 +1,5 @@
 import { t as clearOnUserChange } from "../user-change-DgWC6RRC.js";
-import { a as createActionRunner, c as liveKey, d as shownCount, f as startBroadcast, i as countSource, l as notJoined, m as startLiveQuery, n as assertInvalidateClient, o as joinPresence, p as startLiveCount, r as callerOf, s as keyed, t as NO_COUNT, u as plainCaller } from "../client-BAEbEA7t.js";
+import { a as createActionRunner, c as liveKey, d as shownCount, f as startBroadcast, i as countSource, l as notJoined, m as startLiveQuery, n as assertInvalidateClient, o as joinPresence, p as startLiveCount, r as callerOf, s as keyed, t as NO_COUNT, u as plainCaller } from "../client-C_mlji5R.js";
 import { t as supportOf } from "../support-view-g4YLBeqX.js";
 import { c as listenToBlockEvents, d as fieldErrorsOf, i as dataTarget, l as blockEnv, n as createDataOne, o as createBlockMutation, s as createBlockQuery, t as createDataList, u as withEnv } from "../data-hooks-tgF1Ct0F.js";
 import { computed, getCurrentInstance, getCurrentScope, inject, onMounted, onScopeDispose, provide, readonly, shallowRef, toValue, watch } from "vue";

package/dist/{watch-topic-Bo9S2R4P.d.ts → watch-topic-BAxoPKZx.d.ts}

@@ -1,4 +1,4 @@
-import { c as RealtimeClient, p as SubscriptionStatus } from "./topic-DNFEFGKI.js";
+import { c as RealtimeClient, p as SubscriptionStatus } from "./topic-CZXHhZye.js";
 //#region src/realtime/watch-topic.d.ts
 interface TopicWatch {
   readonly onMessage: (event: string, payload: unknown) => void;

package/dist/yjs/index.d.ts

@@ -1,5 +1,5 @@
 import { t as AsyncResult } from "../result-DZeA5KS6.js";
-import { c as RealtimeClient, r as PresenceMember } from "../topic-DNFEFGKI.js";
+import { c as RealtimeClient, r as PresenceMember } from "../topic-CZXHhZye.js";
 import { a as DocumentSuggestion, d as OpenedDocument, l as Documents, r as DocumentRef, t as DecidedSuggestion } from "../documents-Cup1rpjF.js";
 //#region src/yjs/yjs.d.ts
 type PresenceState = Readonly<Record<string, unknown>>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "better-supabase",
-  "version": "0.15.1",
+  "version": "0.16.0",
   "description": "Strongly typed Supabase: generated schema, typed repositories, plugins, auth glue, framework integrations and the better-supabase CLI.",
   "keywords": [
     "cli",

package/skills/better-supabase-api/SKILL.md

@@ -144,11 +144,13 @@ and upload through `bsb.db`, as in [references/powersync.md](references/powersyn
 
 - `createQueue({ sql: postgres.admin, queues: { queue_name: zodSchema } })` runs on Supabase Queues (pgmq): `enqueue(queue, payload, { context: db.$context })` in the request, then `work` or `drain` in a worker, where `const db = await bsb.forContext(job.context).orThrow()` runs the work as the enqueuing user with RLS (it fails with `forbidden` for a job without a user; use `bsb.admin(job.context)` only for work no user owns). The handler throws to retry. `schedule(name, cron, queue, payload, { timeZone })` uses pg_cron, or with `blocks.queue.options.scheduler: "drain"` a `jobs.drainRoute({ secret: process.env.CRON_SECRET, handlers })` route that Vercel Cron calls; `blocks.queue.options.backend: "table"` runs without pgmq. Queue names are lowercase letters, digits and underscores. With a service-role Supabase client instead of SQL, it uses the `pgmq_public` RPCs (no dedupe or schedules).
 - `createIdempotency({ sql: postgres.admin }).handle(request, handler)` for POST endpoints that clients retry.
+- `createRateLimit({ sql: postgres.admin })` limits keys that aren't claims: `check(scope, key, rule?)` for one limit, `checkAll([{ scope, key, rule? }, ...])` for several in one round trip that counts only when all allow (each limit its own scope; `blocked` names the refusing one). Answer a refusal with `rateLimited(decision)`.
+- Large browser uploads: `bucket.connect(client).reserveResumable(target)` (`better-supabase/storage`) signs a TUS upload and returns `{ tusEndpoint, headers, metadata, expiresAt, bucket, path, token }`; hand `endpoint: tusEndpoint`, `headers` (`x-signature`, `x-upsert`) and `metadata` (plus `contentType`) to `tus-js-client`, so the browser needs no access token. Call `claimReserved(reservation)` afterwards, which a support session needs.
 - `createWebhookInbox({ transport: sqlTransport(postgres.admin), source, secrets }).receive(request)` for webhooks; `process(handler)` later. `createInbox` is the conversation inbox (`blocks/inbox`), not this.
 - Times are `Temporal.Instant`: `EnqueueOptions.runAt`, `Job.enqueuedAt`, `Job.visibleUntil`, `WebhookInboxMessage.receivedAt` and webhook timestamps.
 - Schedule cleanup with pg_cron at a quiet hour: `better_supabase.purge_job_archive('<queue>')`, `purge_webhooks()`, `purge_audit_log()`, `purge_idempotency_keys()`, `purge_rate_limits()`, `purge_outbox()`, `purge_notifications()` and `purge_webhook_deliveries()`, for the modules you installed. Only `service_role` can execute them.
 - Audit a table with `better_supabase.audit('public.t', redact => '{secret}', event_prefix => 't')`. Each call replaces all of the table's settings, so a second call without `ignore` and `redact` clears them; read `audit_settings('public.t')` first when another package also registers the table; record non-row events with `better_supabase.audit_event(event_type, ...)` and an `idempotency_key`. For per-tenant retention, write an `audit_retention(tenant)` SQL function or call `purgeAuditLog(sql, { retention })` from `better-supabase/blocks/audit`, which also has `auditListQuery` and `exportAuditLog` (NDJSON or OCSF). `upgrade` writes a pgTAP file per audited table, and doctor BS315 lists tables without the trigger; exempt the rest with `blocks.audit.options.exempt` globs.
-- For a "view as user" support mode, add the `impersonation` SQL module, pass `support: supportSessions({ store: sqlSupportStore(postgres) })` to `createServer`, call `bsb.startSupport({ targetUserId, reason })` and `bsb.stopSupport()` from server actions, and show a banner with `useSupportSession()`. Sessions are read-only by default; grant admins the `support.start` platform permission.
+- For a "view as user" support mode, add the `impersonation` SQL module, pass `support: supportSessions({ store: sqlSupportStore(postgres) })` to `createServer`, call `bsb.startSupport({ targetUserId, reason })` and `bsb.stopSupport()` from server actions, and show a banner with `useSupportSession()`. Sessions are read-only by default; grant admins the `support.start` platform permission. Realtime in a support session (or with httpOnly cookies) goes through `export const { GET, POST } = realtimeRelay(bsb, { topics: [myTopic, liveRelayTopic], postgres })` from `better-supabase/server`, which checks each topic's `realtime.messages` policies as the viewed user; pass `realtime={useRealtimeRelay("/api/realtime")}` to `<BetterSupabaseProvider>` (or `relayRealtimeClient(url)` / `relayTopicPort(url)` from `better-supabase/realtime`) so `subscribe`, `useBroadcast`, `usePresence` and `useLiveQuery` work unchanged. Never subscribe in the browser with the admin's own client during a support session.
 - For teams, add the `organizations` and `invitations` SQL modules and call them through `createOrganizations({ transport: sqlTransport(postgres.asUser(claims)), events: betterSupabase.events, onInvite })` from `better-supabase/blocks/organizations`. Send the invitation email in `onInvite`, show `previewInvitation(token)` on the accept page, and switch with `organizations.switch(id)`, refreshing the session when it returns `refresh: true`. Errors carry codes such as `ORGANIZATION_SLUG_TAKEN` in `hint`. Tables your schema already has are detected and kept; map other names with `tables` and `columns`.
 - For user profiles, add the `profiles` SQL module: sign-up creates the row from auth metadata with a unique username and mirrors the email; users update only the `updatable` columns. An existing `profiles` table is detected and kept: the block adds only the columns it lacks, `tables` and `columns` map other names, and `syncTrigger: false` leaves profile creation to your own trigger. Use `avatarBucket()` and `organizationLogoBucket()` from `better-supabase/storage` for uploads; `policy: { access: { read, write } }` checks any bucket through the access contract.
 - For events other systems must see, add the `outbox` SQL module and write events with `emit_event(type, payload, subject, tenant, key)` inside the same transaction as the change (the SQL modules emit theirs automatically). Relay them with `createOutbox({ transport: sqlTransport(postgres.admin), source }).relayRoute({ secret, consumers: { name: httpSink(url) } })` from `better-supabase/blocks/outbox` after `outbox.register(name, { types })`. Delivery is at least once; receivers deduplicate on the CloudEvent `id`.

package/skills/better-supabase-auth/SKILL.md

@@ -118,6 +118,13 @@ A proxy or middleware with its own Supabase client calls
 `sessionStatus(request, { url, publishableKey })` from `better-supabase/ssr`
 (`"ended"` on a 401 or 403 from Auth; treat `"unknown"` as active) and
 `clearSessionCookies(request, response, { url })` before redirecting.
+An app with httpOnly session cookies and no browser Supabase client watches
+an open page with `export const GET = sessionStatusRoute(bsb)` (from
+`better-supabase/server`) and `useSessionWatch({ redirect: "/login" })` (from
+`better-supabase/next/client`): it checks on focus, visibility and an
+interval, reloads on `ended`, `banned` or `signed_out`, refreshes the router
+on `claims_changed` (the claims fingerprint, support target included, moved)
+and tells the other tabs over a `BroadcastChannel`.
 
 Done when the irreversible action returns `SESSION_REVOKED` for a signed-out
 session in a test.

package/dist/cli/add-CUH0rORo.js

@@ -1 +0,0 @@
-export { t as addCommand } from "./add-DNOL9PDu.js";