better-supabase 0.2.0 → 0.3.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "better-supabase",
-  "version": "0.2.0",
-  "description": "Strongly typed Supabase: generated schema, typed repositories, plugins, auth glue and framework integrations, with a CLI from day one.",
+  "version": "0.3.0",
+  "description": "Strongly typed Supabase: generated schema, typed repositories, plugins, auth glue and framework integrations. The CLI ships as @better-supabase/cli.",
   "keywords": [
     "hono",
     "mcp",
@@ -25,11 +25,7 @@
     "url": "git+https://github.com/ScaleDockHQ/better-supabase.git",
     "directory": "packages/better-supabase"
   },
-  "bin": {
-    "better-supabase": "./bin/better-supabase.js"
-  },
   "files": [
-    "bin",
     "dist",
     "schemas",
     "skills",
@@ -160,14 +156,14 @@
       "types": "./dist/plugins/validation/index.d.ts",
       "default": "./dist/plugins/validation/index.js"
     },
+    "./sql": {
+      "types": "./dist/sql/index.d.ts",
+      "default": "./dist/sql/index.js"
+    },
     "./testing": {
       "types": "./dist/testing/index.d.ts",
       "default": "./dist/testing/index.js"
     },
-    "./cli": {
-      "types": "./dist/cli/index.d.ts",
-      "default": "./dist/cli/index.js"
-    },
     "./schemas/*.json": "./schemas/*.json",
     "./package.json": "./package.json"
   },
@@ -177,19 +173,17 @@
   },
   "dependencies": {
     "@standard-schema/spec": "1.1.0",
-    "@supabase/middleware": "0.6.0",
-    "@supabase/postgrest-typegen": "0.2.2",
-    "@supabase/server": "1.8.1",
+    "@supabase/middleware": "1.0.0",
+    "@supabase/postgrest-typegen": "0.3.1",
+    "@supabase/server": "1.9.0",
     "@supabase/ssr": "0.12.7"
   },
   "devDependencies": {
     "@arethetypeswrong/cli": "0.18.5",
     "@better-supabase/ox-config": "0.0.0",
     "@better-supabase/typescript-config": "0.0.0",
-    "@effect/platform-node": "4.0.0-rc.117",
     "@opentelemetry/api": "1.9.1",
     "@orpc/server": "2.0.0-beta.40",
-    "@supabase/config": "0.10.0",
     "@supabase/supabase-js": "2.117.2",
     "@tanstack/query-core": "5.104.0",
     "@tanstack/react-query": "5.104.0",
@@ -198,32 +192,33 @@
     "@types/react": "19.3.0",
     "@types/react-dom": "19.3.0",
     "@valibot/to-json-schema": "1.8.0",
-    "@vitest/coverage-v8": "5.0.2",
-    "effect": "4.0.0-rc.117",
-    "hono": "4.13.10",
-    "next": "16.3.7",
-    "oxfmt": "0.71.0",
+    "@vitest/coverage-v8": "5.0.3",
+    "ajv": "8.20.0",
+    "ajv-formats": "3.0.1",
+    "hono": "4.13.12",
+    "next": "16.3.8",
     "oxlint": "1.86.0",
-    "pg": "8.23.0",
+    "pg": "8.23.1",
     "publint": "0.3.24",
     "react": "19.3.0",
     "react-dom": "19.3.0",
+    "temporal-polyfill": "1.0.5",
     "tsdown": "0.23.0",
     "typescript": "7.0.2",
     "valibot": "1.5.0",
-    "vitest": "5.0.2",
+    "vitest": "5.0.3",
     "zod": "4.6.5"
   },
   "peerDependencies": {
     "@opentelemetry/api": ">=1.9",
     "@orpc/server": ">=2.0.0-0",
-    "@supabase/config": ">=0.9.0 <0.11",
     "@supabase/supabase-js": "^2.116.0",
     "@tanstack/query-core": "^5",
     "hono": ">=4",
     "next": ">=16",
     "pg": ">=8",
-    "react": "^19"
+    "react": "^19",
+    "temporal-polyfill": ">=1"
   },
   "peerDependenciesMeta": {
     "@opentelemetry/api": {
@@ -232,9 +227,6 @@
     "@orpc/server": {
       "optional": true
     },
-    "@supabase/config": {
-      "optional": true
-    },
     "@tanstack/query-core": {
       "optional": true
     },
@@ -249,6 +241,9 @@
     },
     "react": {
       "optional": true
+    },
+    "temporal-polyfill": {
+      "optional": true
     }
   },
   "engines": {
@@ -260,6 +255,7 @@
     "check:publish": "publint && pnpm pack --out pack.tgz && attw --profile esm-only pack.tgz && rm -f pack.tgz",
     "lint": "oxlint",
     "test": "vitest run --coverage",
-    "typecheck": "tsc --noEmit --checkers 4"
+    "transit": "true",
+    "typecheck": "tsc --noEmit"
   }
 }

package/schemas/config-v1.json

@@ -67,7 +67,7 @@
       "type": "object",
       "additionalProperties": false,
       "properties": {
-        "timestamptz": { "enum": ["string", "date"], "default": "string" },
+        "timestamptz": { "enum": ["string", "instant"], "default": "string" },
         "int8": { "enum": ["number", "string", "bigint"], "default": "number" },
         "numeric": { "enum": ["number", "string"], "default": "number" }
       }
@@ -283,6 +283,36 @@
           "description": "The tenant id column of that table.",
           "type": "string",
           "default": "id"
+        },
+        "permdock": {
+          "description": "With a PermDock manifest, read PermDock's memberships for this scope instead of better_supabase.memberships; false keeps the kit's table.",
+          "oneOf": [
+            { "const": false },
+            {
+              "type": "object",
+              "additionalProperties": false,
+              "properties": {
+                "scope": { "type": "string", "default": "organization" }
+              }
+            }
+          ]
+        }
+      }
+    },
+    "permdock": {
+      "description": "Where PermDock's JSON outputs are.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "manifest": {
+          "description": "What `permdock supabase inspect --out` writes.",
+          "type": "string",
+          "default": "permdock.manifest.json"
+        },
+        "catalog": {
+          "description": "What `permdock catalog` writes.",
+          "type": "string",
+          "default": "permissions.catalog.json"
         }
       }
     },

package/schemas/doctor-report-v1.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://unpkg.com/better-supabase/schemas/doctor-report-v1.json",
   "title": "better-supabase doctor report",
-  "description": "Output of `better-supabase doctor --format json`.",
+  "description": "Output of `better-supabase doctor --json`.",
   "type": "object",
   "additionalProperties": false,
   "required": ["$schema", "version", "tool", "summary", "findings"],
@@ -42,6 +42,12 @@
               "BS106",
               "BS107",
               "BS108",
+              "BS109",
+              "BS110",
+              "BS111",
+              "BS112",
+              "BS113",
+              "BS114",
               "BS200",
               "BS204",
               "BS205",
@@ -52,6 +58,15 @@
               "BS210",
               "BS211",
               "BS212",
+              "BS213",
+              "BS214",
+              "BS215",
+              "BS216",
+              "BS217",
+              "BS218",
+              "BS219",
+              "BS220",
+              "BS221",
               "BS301",
               "BS302",
               "BS303",
@@ -65,6 +80,7 @@
               "BS405",
               "BS406",
               "BS407",
+              "BS408",
               "BS501",
               "BS502"
             ]

package/schemas/snapshot-v2.json

@@ -690,6 +690,12 @@
                 "additionalProperties": {
                   "type": "string"
                 }
+              },
+              "execute": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
               }
             }
           }
@@ -901,6 +907,12 @@
               },
               "partial": {
                 "type": "boolean"
+              },
+              "method": {
+                "type": "string"
+              },
+              "predicate": {
+                "type": ["string", "null"]
               }
             }
           }
@@ -996,6 +1008,29 @@
             }
           }
         },
+        "columnGrants": {
+          "description": "Column-level insert and update grants to anon and authenticated. Absent in snapshots taken before they were introspected.",
+          "type": "array",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["column", "role", "privileges"],
+            "properties": {
+              "column": {
+                "type": "string"
+              },
+              "role": {
+                "type": "string"
+              },
+              "privileges": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              }
+            }
+          }
+        },
         "large": {
           "description": "Postgres estimates at least 10,000 rows; the unbounded-read lint rule reads it.",
           "const": true

package/skills/better-supabase/SKILL.md

@@ -11,13 +11,22 @@ The data layer is `sb = defineSupabase(schema)` in `src/lib/supabase.ts`.
 
 ## Workflow: change the schema
 
-1. Write the migration (`supabase/schemas/*.sql` plus `supabase db diff`, or
-   `supabase migration new`).
-2. Apply it with `supabase db reset` (or `supabase migration up`).
-3. Run `pnpm better-supabase gen`, then fix the type errors it surfaces.
-4. Run `pnpm better-supabase doctor` and fix every error it reports (RLS off,
-   missing policies, unindexed foreign keys, drift).
-5. Commit the generated files. CI runs `better-supabase gen --check`.
+1. Write the migration: edit `supabase/schemas/*.sql`, then run
+   `supabase db schema declarative sync -f <name>` (pg-delta;
+   `supabase db diff -f <name>` when `config.toml` has no
+   `[experimental.pgdelta] enabled = true`), or `supabase migration new` for
+   data and role settings.
+2. For a new table in an exposed schema, in the same file: `enable row level
+security`, a policy per role and command the app uses, and an index on
+   every column a policy filters by. List the table in `expose` in
+   `better-supabase.config.ts` and run `pnpm better-supabase sql add grants`:
+   new tables get no Data API grants on their own.
+3. Apply it with `supabase db reset` (or `supabase migration up`).
+4. Run `pnpm better-supabase gen`, then fix the type errors it surfaces.
+   The command comes from the `@better-supabase/cli` dev dependency.
+5. Run `pnpm better-supabase doctor` and fix every error it reports (RLS off,
+   missing policies, missing grants, unindexed foreign keys, drift).
+6. Commit the generated files. CI runs `better-supabase gen --check`.
 
 Done when `gen --check` and `doctor` exit 0 and the project typechecks.
 
@@ -48,10 +57,10 @@ stay hidden.
 
 ```ts
 const result = await db.customers.findMany({
-  select: ['id', 'name'],
-  where: { status: 'active', notes: { some: { kind: 'call' } } },
-  include: { organization: { select: ['name'] } },
-  orderBy: { name: 'asc' },
+  select: ["id", "name"],
+  where: { status: "active", notes: { some: { kind: "call" } } },
+  include: { organization: { select: ["name"] } },
+  orderBy: { name: "asc" },
   limit: 20,
 });
 if (!result.ok) return result; // DbError: kind, message, status, code
@@ -82,3 +91,6 @@ See [references/troubleshooting.md](references/troubleshooting.md) for each
 https://bettersupabase.com/docs. Every page is also served as Markdown at
 `https://bettersupabase.com/docs/<path>.md`, and
 https://bettersupabase.com/llms.txt lists them all.
+
+For Supabase itself (Auth, Storage, RLS, Postgres performance), install
+Supabase's skills next to these: `npx skills add supabase/agent-skills`.

package/skills/better-supabase/references/plugins.md

@@ -1,15 +1,15 @@
 # Plugins
 
 ```ts title="src/lib/supabase.ts"
-import { defineSupabase } from 'better-supabase';
-import { actor } from 'better-supabase/plugins/actor';
-import { softDelete } from 'better-supabase/plugins/soft-delete';
-import { tenant } from 'better-supabase/plugins/tenant';
-import { timestamps } from 'better-supabase/plugins/timestamps';
-import { validation } from 'better-supabase/plugins/validation';
+import { defineSupabase } from "better-supabase";
+import { actor } from "better-supabase/plugins/actor";
+import { softDelete } from "better-supabase/plugins/soft-delete";
+import { tenant } from "better-supabase/plugins/tenant";
+import { timestamps } from "better-supabase/plugins/timestamps";
+import { validation } from "better-supabase/plugins/validation";
 
-import { schema } from './supabase/generated.ts';
-import { validators } from './supabase/generated.zod.ts';
+import { schema } from "./supabase/generated.ts";
+import { validators } from "./supabase/generated.zod.ts";
 
 export const sb = defineSupabase(schema)
   .use(timestamps())
@@ -34,14 +34,14 @@ plugins: {
 A table without the columns is left alone, and the types follow:
 `restore()` and `withDeleted` only exist on soft-delete tables.
 
-| Plugin | What it does | Don't |
-| --- | --- | --- |
-| `timestamps()` | Sets `createdAt` and `updatedAt` | set them in `create` or `update` |
-| `softDelete()` | Hides deleted rows, turns `delete` into an update, adds `restore` | filter `deletedAt: null` by hand |
-| `tenant()` | Scopes queries to the request's tenant and fills it on insert | pass `organizationId` from the client |
-| `actor()` | Sets `createdBy` and `updatedBy` | pass the user id yourself |
-| `validation()` | Validates writes with any Standard Schema | validate the same input twice |
-| `rules()` | Flags unbounded reads, missing tenants, sensitive columns and admin keys in the browser | disable a rule without a reason |
+| Plugin         | What it does                                                                            | Don't                                 |
+| -------------- | --------------------------------------------------------------------------------------- | ------------------------------------- |
+| `timestamps()` | Sets `createdAt` and `updatedAt`                                                        | set them in `create` or `update`      |
+| `softDelete()` | Hides deleted rows, turns `delete` into an update, adds `restore`                       | filter `deletedAt: null` by hand      |
+| `tenant()`     | Scopes queries to the request's tenant and fills it on insert                           | pass `organizationId` from the client |
+| `actor()`      | Sets `createdBy` and `updatedBy`                                                        | pass the user id yourself             |
+| `validation()` | Validates writes with any Standard Schema                                               | validate the same input twice         |
+| `rules()`      | Flags unbounded reads, missing tenants, sensitive columns and admin keys in the browser | disable a rule without a reason       |
 
 ## Order
 
@@ -59,7 +59,10 @@ Never read it from `user_metadata`, a URL or a request body. When the project
 has a `permdock.config.ts`, PermDock's hook writes that claim and the
 memberships; don't run `sql add tenant` there or call `membership_claims()`
 from a hook. `sql add entitlements` is fine: `features` is not a PermDock
-claim, but PermDock's hook doesn't write it yet, so read entitlements from the
-database on the server instead of `hasEntitlement(session, ...)`.
+claim. Add `claims: { features: 'better_supabase.feature_claims' }` to
+`supabase.hook` in `permdock.config.ts`, run `permdock supabase hook generate`,
+and `hasEntitlement(session, ...)` works. Run `permdock supabase inspect --out`
+first: with `permdock.manifest.json` present, the entitlements module reads
+PermDock's `member_<scope>_ids` helpers and doesn't add `tenant`.
 
 Docs: https://bettersupabase.com/docs/plugins.md

package/skills/better-supabase/references/troubleshooting.md

@@ -7,21 +7,21 @@ Start with `pnpm better-supabase doctor`. It checks the database, RLS,
 
 Branch on `result.error.kind`, not on the message.
 
-| Kind | Usual cause | Fix |
-| --- | --- | --- |
-| `not_found` | The row doesn't exist, or RLS hides it from this user | Check the policy with an `asUser` test before assuming the row is gone |
-| `unauthorized` | No valid session or token | Get `db` from the adapter for this request |
-| `forbidden` | RLS or a grant rejected the write | Fix the policy or the grant; don't switch to `server.admin()` |
-| `conflict` | Unique violation | Use `upsert`, or return the error to the caller |
-| `foreign_key` | Referenced row missing, or still referenced on delete | Create the parent first, or delete children |
-| `not_null`, `check`, `exclusion` | A constraint rejected the row | Validate input earlier with the `validation()` plugin |
-| `invalid_input` | Postgres couldn't parse a value (bad uuid, enum) | Validate before the call |
-| `validation` | A Standard Schema rejected the input; see `issues` | Show the issues to the user |
-| `invalid_request` | The query can't run over PostgREST (for example a relation filter on `update`) | Read the keys first, or use a database function or `better-supabase/postgres` |
-| `multiple_rows` | `findUnique` or a single-row write matched more than one row | Filter by a unique key |
-| `stale` | `update(..., { expect })` found a newer row | Reload the row and retry |
-| `serialization`, `timeout`, `network`, `rate_limited` | Transient | Retry with backoff, or surface the error |
-| `raised` | A database function raised an exception | Read `message` and `code` from the function |
+| Kind                                                  | Usual cause                                                                    | Fix                                                                           |
+| ----------------------------------------------------- | ------------------------------------------------------------------------------ | ----------------------------------------------------------------------------- |
+| `not_found`                                           | The row doesn't exist, or RLS hides it from this user                          | Check the policy with an `asUser` test before assuming the row is gone        |
+| `unauthorized`                                        | No valid session or token                                                      | Get `db` from the adapter for this request                                    |
+| `forbidden`                                           | RLS or a grant rejected the write                                              | Fix the policy or the grant; don't switch to `server.admin()`                 |
+| `conflict`                                            | Unique violation                                                               | Use `upsert`, or return the error to the caller                               |
+| `foreign_key`                                         | Referenced row missing, or still referenced on delete                          | Create the parent first, or delete children                                   |
+| `not_null`, `check`, `exclusion`                      | A constraint rejected the row                                                  | Validate input earlier with the `validation()` plugin                         |
+| `invalid_input`                                       | Postgres couldn't parse a value (bad uuid, enum)                               | Validate before the call                                                      |
+| `validation`                                          | A Standard Schema rejected the input; see `issues`                             | Show the issues to the user                                                   |
+| `invalid_request`                                     | The query can't run over PostgREST (for example a relation filter on `update`) | Read the keys first, or use a database function or `better-supabase/postgres` |
+| `multiple_rows`                                       | `findUnique` or a single-row write matched more than one row                   | Filter by a unique key                                                        |
+| `stale`                                               | `update(..., { expect })` found a newer row                                    | Reload the row and retry                                                      |
+| `serialization`, `timeout`, `network`, `rate_limited` | Transient                                                                      | Retry with backoff, or surface the error                                      |
+| `raised`                                              | A database function raised an exception                                        | Read `message` and `code` from the function                                   |
 
 ## Other symptoms
 

package/skills/better-supabase-api/SKILL.md

@@ -32,13 +32,13 @@ and `['service']` for machine callers. Rejected callers get a 401 with a
 
 ## Adapters
 
-| Where | Setup | Handler |
-| --- | --- | --- |
-| Next.js | `createNext(sb)` in `lib/supabase.server.ts` | `next.route((req, { db }) => ...)`, `next.action({ input: schema }, (input, { db }) => ...)` |
-| Hono | `createHono(sb)`, `.use('/api/*', bs.middleware())` | `c.var.db`; `bs.resource('customers', {...})` for REST |
-| oRPC | `createOrpc(sb)`, `base.use(bs.middleware())` | `bs.unwrap(context.db.customers.findMany(...))` |
-| Edge Functions | `createEdge(sb, { cors: true })` | `Deno.serve(bs.handler((req, { db }) => ...))` |
-| MCP | `createMcp(sb, { name, version, resources })` | `.tool({ name, input, run: (args, { db }) => ... })` |
+| Where          | Setup                                               | Handler                                                                                      |
+| -------------- | --------------------------------------------------- | -------------------------------------------------------------------------------------------- |
+| Next.js        | `createNext(sb)` in `lib/supabase.server.ts`        | `next.route((req, { db }) => ...)`, `next.action({ input: schema }, (input, { db }) => ...)` |
+| Hono           | `createHono(sb)`, `.use('/api/*', bs.middleware())` | `c.var.db`; `bs.resource('customers', {...})` for REST                                       |
+| oRPC           | `createOrpc(sb)`, `base.use(bs.middleware())`       | `bs.unwrap(context.db.customers.findMany(...))`                                              |
+| Edge Functions | `createEdge(sb, { cors: true })`                    | `Deno.serve(bs.handler((req, { db }) => ...))`                                               |
+| MCP            | `createMcp(sb, { name, version, resources })`       | `.tool({ name, input, run: (args, { db }) => ... })`                                         |
 
 Don't build error JSON by hand; errors become Problem Details.
 

package/skills/better-supabase-api/references/adapters.md

@@ -3,11 +3,11 @@
 Each adapter wraps the same `sb` from `src/lib/supabase.ts`:
 
 ```ts title="src/lib/supabase.ts"
-import { defineSupabase } from 'better-supabase';
+import { defineSupabase } from "better-supabase";
 
-import { schema } from './supabase/generated';
+import { schema } from "./supabase/generated";
 
-export type { Functions, Models } from './supabase/generated';
+export type { Functions, Models } from "./supabase/generated";
 
 export const sb = defineSupabase(schema);
 ```
@@ -15,17 +15,17 @@ export const sb = defineSupabase(schema);
 ## Next.js
 
 ```ts title="src/lib/supabase.server.ts"
-import { createNext } from 'better-supabase/next';
+import { createNext } from "better-supabase/next";
 
-import { sb } from './supabase';
+import { sb } from "./supabase";
 
 export const next = createNext(sb);
 ```
 
 ```ts title="src/proxy.ts"
-import type { NextRequest } from 'next/server';
+import type { NextRequest } from "next/server";
 
-import { next } from './lib/supabase.server';
+import { next } from "./lib/supabase.server";
 
 export const proxy = (request: NextRequest) => next.proxy(request);
 ```
@@ -35,24 +35,29 @@ route handlers and actions read the verified token:
 
 ```ts
 const { db } = await next.server();
-export const GET = next.route((request, { db }) => db.customers.findMany({ limit: 20 }));
+export const GET = next.route((request, { db }) =>
+  db.customers.findMany({ limit: 20 }),
+);
 ```
 
 ## Hono
 
 ```ts title="src/server.ts"
-import { type BetterEnv, createHono } from 'better-supabase/hono';
-import { Hono } from 'hono';
+import { type BetterEnv, createHono } from "better-supabase/hono";
+import { Hono } from "hono";
 
-import { type Functions, type Models, sb } from './lib/supabase';
+import { type Functions, type Models, sb } from "./lib/supabase";
 
 const bs = createHono(sb);
 
 const app = new Hono<BetterEnv<Models, Functions, unknown>>()
   .onError(bs.onError)
-  .use('/api/*', bs.middleware())
-  .get('/api/me', (c) => c.json({ kind: c.var.auth.kind }))
-  .route('/api/customers', bs.resource('customers', { select: ['id', 'name'] }));
+  .use("/api/*", bs.middleware())
+  .get("/api/me", (c) => c.json({ kind: c.var.auth.kind }))
+  .route(
+    "/api/customers",
+    bs.resource("customers", { select: ["id", "name"] }),
+  );
 
 export default app;
 ```
@@ -60,10 +65,10 @@ export default app;
 ## oRPC
 
 ```ts title="src/router.ts"
-import { os } from '@orpc/server';
-import { createOrpc, type OrpcRequestContext } from 'better-supabase/orpc';
+import { os } from "@orpc/server";
+import { createOrpc, type OrpcRequestContext } from "better-supabase/orpc";
 
-import { sb } from './lib/supabase';
+import { sb } from "./lib/supabase";
 
 export const bs = createOrpc(sb);
 const authed = os.$context<OrpcRequestContext>().use(bs.middleware());
@@ -78,28 +83,28 @@ export const router = {
 ## Edge Functions
 
 ```ts title="supabase/functions/api/index.ts"
-import { createEdge } from 'better-supabase/edge';
+import { createEdge } from "better-supabase/edge";
 
-import { sb } from '../_shared/supabase.ts';
+import { sb } from "../_shared/supabase.ts";
 
 const bs = createEdge(sb, { cors: true });
 
 Deno.serve(
-  bs.resources({ customers: { select: ['id', 'name'] } }, { basePath: '/api' }),
+  bs.resources({ customers: { select: ["id", "name"] } }, { basePath: "/api" }),
 );
 ```
 
 ## MCP
 
 ```ts title="supabase/functions/mcp/index.ts"
-import { createMcp } from 'better-supabase/mcp';
+import { createMcp } from "better-supabase/mcp";
 
-import { sb } from '../_shared/supabase.ts';
+import { sb } from "../_shared/supabase.ts";
 
 const mcp = createMcp(sb, {
-  name: 'crm',
-  version: '0.1.0',
-  resources: { customers: { select: ['id', 'name'] } },
+  name: "crm",
+  version: "0.1.0",
+  resources: { customers: { select: ["id", "name"] } },
 });
 
 Deno.serve(mcp.fetch);

package/skills/better-supabase-testing/SKILL.md

@@ -11,7 +11,8 @@ supabase-js, and don't use the service role for anything a user does.
 ## Workflow: test a table or policy
 
 1. Start the stack (`supabase start`) and write `.env.local` with
-   `better-supabase env`.
+   `better-supabase env`. In a sandbox without Docker, start it with
+   `SUPABASE_EXPERIMENTAL_STACK=1` (the Supabase CLI's native stack).
 2. Add the rows the test needs to `supabase/seed.ts`, including one row
    owned by another tenant, then `supabase db reset`.
 3. Write the RLS test with `asUser` for each role that matters.
@@ -29,24 +30,26 @@ again once you restore it.
 - Typed fixtures live in `supabase/seed.ts`:
 
 ```ts
-import { defineSeed } from 'better-supabase/testing';
-import { sb } from '../src/lib/supabase.ts';
+import { defineSeed } from "better-supabase/testing";
+import { sb } from "../src/lib/supabase.ts";
 
 export const seed = defineSeed(sb, {
-  organizations: { acme: { id: ACME, name: 'Acme' } },
-  customers: { first: { id: FIRST, organizationId: ACME, name: 'First' } },
+  organizations: { acme: { id: ACME, name: "Acme" } },
+  customers: { first: { id: FIRST, organizationId: ACME, name: "First" } },
 });
 ```
 
-  `better-supabase seed` renders them to SQL for `supabase db reset`, and
-  tests import the same rows (`seed.rows.customers.first.id`).
+`better-supabase seed` renders them to SQL for `supabase db reset`, and
+tests import the same rows (`seed.rows.customers.first.id`).
 
 ## RLS tests
 
 ```ts
 const alice = await asUser(sb, { sub: aliceId, tenant_id: ACME }, { postgres });
 expect(await alice.db.customers.count().orThrow()).toBe(1);
-expect(await alice.db.customers.findById(OTHER_ORG_CUSTOMER)).toMatchObject({ ok: false });
+expect(await alice.db.customers.findById(OTHER_ORG_CUSTOMER)).toMatchObject({
+  ok: false,
+});
 ```
 
 - Check both directions: the user sees their own rows and never sees another tenant's.

package/bin/better-supabase.js

@@ -1,4 +0,0 @@
-#!/usr/bin/env node
-// Checked in so pnpm can link the bin on a fresh install, before dist/ is built.
-// oxlint-disable-next-line import/no-unassigned-import -- the CLI module runs on import.
-import "../dist/cli/bin.js";