better-supabase 0.15.1 → 0.17.0

package/schemas/config-v1.json

@@ -217,6 +217,12 @@
               "type": "string",
               "description": "Who a block's rows belong to, unless the block sets its own scope: tenant (the default), user (the signed-in user, no tenants) or none (one shared space every signed-in user uses).",
               "default": "tenant"
+            },
+            "ownTablePolicies": {
+              "enum": ["block", "app"],
+              "type": "string",
+              "description": "Whose policies govern the app's tables a block runs over, unless the block sets its own ownTablePolicies: block (the default) lets a block add its bsb_ policies where none of the app's covers them, and app keeps every bsb_ policy, permissive or restrictive, off them.",
+              "default": "block"
             }
           },
           "additionalProperties": false
@@ -3050,6 +3056,11 @@
           "type": "string",
           "description": "Who the block's rows belong to: tenant, user or none. Defaults to database.sql.owner, then tenant."
         },
+        "ownTablePolicies": {
+          "enum": ["block", "app"],
+          "type": "string",
+          "description": "Whose policies govern the app's tables this block runs over: block lets it add its bsb_ policies where none of the app's covers them, app keeps every bsb_ policy, permissive or restrictive, off them. Applies to every app table of the block. Defaults to database.sql.ownTablePolicies, then block."
+        },
         "functions": {
           "type": "object",
           "additionalProperties": {
@@ -3231,6 +3242,11 @@
           "type": "string",
           "description": "Who the block's rows belong to: tenant, user or none. Defaults to database.sql.owner, then tenant."
         },
+        "ownTablePolicies": {
+          "enum": ["block", "app"],
+          "type": "string",
+          "description": "Whose policies govern the app's tables this block runs over: block lets it add its bsb_ policies where none of the app's covers them, app keeps every bsb_ policy, permissive or restrictive, off them. Applies to every app table of the block. Defaults to database.sql.ownTablePolicies, then block."
+        },
         "functions": {
           "type": "object",
           "properties": {
@@ -4257,6 +4273,9 @@
               "impersonatedBy": {
                 "type": "string",
                 "default": "impersonated_by"
+              },
+              "stamp": {
+                "default": "client"
               }
             }
           }
@@ -6152,6 +6171,9 @@
               "updatedAt": {
                 "type": "string",
                 "default": "updated_at"
+              },
+              "stamp": {
+                "default": "client"
               }
             }
           }

package/schemas/doctor-report-v1.json

@@ -136,6 +136,7 @@
               "BS347",
               "BS348",
               "BS349",
+              "BS350",
               "BS401",
               "BS402",
               "BS403",

package/skills/better-supabase-api/SKILL.md

@@ -144,11 +144,13 @@ and upload through `bsb.db`, as in [references/powersync.md](references/powersyn
 
 - `createQueue({ sql: postgres.admin, queues: { queue_name: zodSchema } })` runs on Supabase Queues (pgmq): `enqueue(queue, payload, { context: db.$context })` in the request, then `work` or `drain` in a worker, where `const db = await bsb.forContext(job.context).orThrow()` runs the work as the enqueuing user with RLS (it fails with `forbidden` for a job without a user; use `bsb.admin(job.context)` only for work no user owns). The handler throws to retry. `schedule(name, cron, queue, payload, { timeZone })` uses pg_cron, or with `blocks.queue.options.scheduler: "drain"` a `jobs.drainRoute({ secret: process.env.CRON_SECRET, handlers })` route that Vercel Cron calls; `blocks.queue.options.backend: "table"` runs without pgmq. Queue names are lowercase letters, digits and underscores. With a service-role Supabase client instead of SQL, it uses the `pgmq_public` RPCs (no dedupe or schedules).
 - `createIdempotency({ sql: postgres.admin }).handle(request, handler)` for POST endpoints that clients retry.
+- `createRateLimit({ sql: postgres.admin })` limits keys that aren't claims: `check(scope, key, rule?)` for one limit, `checkAll([{ scope, key, rule? }, ...])` for several in one round trip that counts only when all allow (each limit its own scope; `blocked` names the refusing one). Answer a refusal with `rateLimited(decision)`.
+- Large browser uploads: `bucket.connect(client).reserveResumable(target)` (`better-supabase/storage`) signs a TUS upload and returns `{ tusEndpoint, headers, metadata, expiresAt, bucket, path, token }`; hand `endpoint: tusEndpoint`, `headers` (`x-signature`, `x-upsert`) and `metadata` (plus `contentType`) to `tus-js-client`, so the browser needs no access token. Call `claimReserved(reservation)` afterwards, which a support session needs.
 - `createWebhookInbox({ transport: sqlTransport(postgres.admin), source, secrets }).receive(request)` for webhooks; `process(handler)` later. `createInbox` is the conversation inbox (`blocks/inbox`), not this.
 - Times are `Temporal.Instant`: `EnqueueOptions.runAt`, `Job.enqueuedAt`, `Job.visibleUntil`, `WebhookInboxMessage.receivedAt` and webhook timestamps.
 - Schedule cleanup with pg_cron at a quiet hour: `better_supabase.purge_job_archive('<queue>')`, `purge_webhooks()`, `purge_audit_log()`, `purge_idempotency_keys()`, `purge_rate_limits()`, `purge_outbox()`, `purge_notifications()` and `purge_webhook_deliveries()`, for the modules you installed. Only `service_role` can execute them.
 - Audit a table with `better_supabase.audit('public.t', redact => '{secret}', event_prefix => 't')`. Each call replaces all of the table's settings, so a second call without `ignore` and `redact` clears them; read `audit_settings('public.t')` first when another package also registers the table; record non-row events with `better_supabase.audit_event(event_type, ...)` and an `idempotency_key`. For per-tenant retention, write an `audit_retention(tenant)` SQL function or call `purgeAuditLog(sql, { retention })` from `better-supabase/blocks/audit`, which also has `auditListQuery` and `exportAuditLog` (NDJSON or OCSF). `upgrade` writes a pgTAP file per audited table, and doctor BS315 lists tables without the trigger; exempt the rest with `blocks.audit.options.exempt` globs.
-- For a "view as user" support mode, add the `impersonation` SQL module, pass `support: supportSessions({ store: sqlSupportStore(postgres) })` to `createServer`, call `bsb.startSupport({ targetUserId, reason })` and `bsb.stopSupport()` from server actions, and show a banner with `useSupportSession()`. Sessions are read-only by default; grant admins the `support.start` platform permission.
+- For a "view as user" support mode, add the `impersonation` SQL module, pass `support: supportSessions({ store: sqlSupportStore(postgres) })` to `createServer`, call `bsb.startSupport({ targetUserId, reason })` and `bsb.stopSupport()` from server actions, and show a banner with `useSupportSession()`. Sessions are read-only by default; grant admins the `support.start` platform permission. Realtime in a support session (or with httpOnly cookies) goes through `export const { GET, POST } = realtimeRelay(bsb, { topics: [myTopic, liveRelayTopic], postgres })` from `better-supabase/server`, which checks each topic's `realtime.messages` policies as the viewed user; pass `realtime={useRealtimeRelay("/api/realtime")}` to `<BetterSupabaseProvider>` (or `relayRealtimeClient(url)` / `relayTopicPort(url)` from `better-supabase/realtime`) so `subscribe`, `useBroadcast`, `usePresence` and `useLiveQuery` work unchanged. Never subscribe in the browser with the admin's own client during a support session.
 - For teams, add the `organizations` and `invitations` SQL modules and call them through `createOrganizations({ transport: sqlTransport(postgres.asUser(claims)), events: betterSupabase.events, onInvite })` from `better-supabase/blocks/organizations`. Send the invitation email in `onInvite`, show `previewInvitation(token)` on the accept page, and switch with `organizations.switch(id)`, refreshing the session when it returns `refresh: true`. Errors carry codes such as `ORGANIZATION_SLUG_TAKEN` in `hint`. Tables your schema already has are detected and kept; map other names with `tables` and `columns`.
 - For user profiles, add the `profiles` SQL module: sign-up creates the row from auth metadata with a unique username and mirrors the email; users update only the `updatable` columns. An existing `profiles` table is detected and kept: the block adds only the columns it lacks, `tables` and `columns` map other names, and `syncTrigger: false` leaves profile creation to your own trigger. Use `avatarBucket()` and `organizationLogoBucket()` from `better-supabase/storage` for uploads; `policy: { access: { read, write } }` checks any bucket through the access contract.
 - For events other systems must see, add the `outbox` SQL module and write events with `emit_event(type, payload, subject, tenant, key)` inside the same transaction as the change (the SQL modules emit theirs automatically). Relay them with `createOutbox({ transport: sqlTransport(postgres.admin), source }).relayRoute({ secret, consumers: { name: httpSink(url) } })` from `better-supabase/blocks/outbox` after `outbox.register(name, { types })`. Delivery is at least once; receivers deduplicate on the CloudEvent `id`.

package/skills/better-supabase-auth/SKILL.md

@@ -118,6 +118,13 @@ A proxy or middleware with its own Supabase client calls
 `sessionStatus(request, { url, publishableKey })` from `better-supabase/ssr`
 (`"ended"` on a 401 or 403 from Auth; treat `"unknown"` as active) and
 `clearSessionCookies(request, response, { url })` before redirecting.
+An app with httpOnly session cookies and no browser Supabase client watches
+an open page with `export const GET = sessionStatusRoute(bsb)` (from
+`better-supabase/server`) and `useSessionWatch({ redirect: "/login" })` (from
+`better-supabase/next/client`): it checks on focus, visibility and an
+interval, reloads on `ended`, `banned` or `signed_out`, refreshes the router
+on `claims_changed` (the claims fingerprint, support target included, moved)
+and tells the other tabs over a `BroadcastChannel`.
 
 Done when the irreversible action returns `SESSION_REVOKED` for a signed-out
 session in a test.

package/dist/cli/add-CUH0rORo.js

@@ -1 +0,0 @@
-export { t as addCommand } from "./add-DNOL9PDu.js";

package/dist/cli/seed-D6XijwbR.js

@@ -1 +0,0 @@
-export { n as seedCommand } from "./seed-Cz8PcXeT.js";