better-supabase 0.2.0 → 0.3.0

package/dist/{mfa-CpLfJSde.js → mfa-BxoR1RkN.js}

@@ -1,5 +1,6 @@
 import { n as dbError } from "./errors-Bl3rkOzo.js";
 import { t as consoleLogger } from "./logger-glM28NVN.js";
+import { n as decodeJwtPayload } from "./base64-CQeB1eSf.js";
 import { DEFAULT_COOKIE_OPTIONS, createChunks, isChunkLike, parseCookieHeader, serializeCookieHeader, stringFromBase64URL, stringToBase64URL } from "@supabase/ssr";
 import { extractCredentials, verifyCredentials } from "@supabase/server/core";
 //#region src/auth/impersonation.ts
@@ -22,6 +23,65 @@ function impersonatorOf(claims) {
 	} : { id: sub };
 }
 //#endregion
+//#region src/auth/actor.ts
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function copyAct(level) {
+	const entries = Object.entries(level).map(([key, value]) => [key, key === "act" && isRecord(value) ? copyAct(value) : value]);
+	return Object.fromEntries(entries);
+}
+/**
+* Reads only `act` and `client_id`, the way PermDock's `actorOf` does. An
+* `act` that is not a chain of objects each with a non-empty `sub` is
+* `{ ok: false }`: the session must not pass as the user alone.
+*/
+function actorOf(claims) {
+	const outer = claims["act"];
+	if (outer !== void 0) {
+		let level = outer;
+		while (level !== void 0) {
+			if (!isRecord(level)) return {
+				ok: false,
+				reason: "invalid-chain"
+			};
+			const sub = level["sub"];
+			if (typeof sub !== "string" || sub === "") return {
+				ok: false,
+				reason: "invalid-chain"
+			};
+			level = level["act"];
+		}
+		if (!isRecord(outer) || typeof outer["sub"] !== "string") return {
+			ok: false,
+			reason: "invalid-chain"
+		};
+		return {
+			ok: true,
+			actor: {
+				id: outer["sub"],
+				kind: "oauth-client",
+				chain: copyAct(outer)
+			}
+		};
+	}
+	const client = claims["client_id"];
+	if (typeof client === "string" && client !== "") return {
+		ok: true,
+		actor: {
+			id: client,
+			kind: "oauth-client"
+		}
+	};
+	return { ok: true };
+}
+/** The OAuth `scope` claim (a space-separated string or a list); `undefined` when empty. */
+function delegationOf(claims) {
+	const scope = claims["scope"];
+	const scopes = typeof scope === "string" ? scope.split(/\s+/u).filter(Boolean) : Array.isArray(scope) ? scope.filter((item) => typeof item === "string") : [];
+	return scopes.length > 0 ? { scopes } : void 0;
+}
+//#endregion
 //#region src/auth/refresh.ts
 /**
 * How long a finished refresh is reused for requests still carrying the old
@@ -191,20 +251,9 @@ function applyCookieWrites(cookies, writes) {
 }
 //#endregion
 //#region src/auth/resolve.ts
-function decodePayload(token) {
-	const part = token.split(".")[1];
-	if (!part) return void 0;
-	try {
-		const json = atob(part.replace(/-/g, "+").replace(/_/g, "/"));
-		const parsed = JSON.parse(json);
-		return typeof parsed === "object" && parsed !== null ? parsed : void 0;
-	} catch {
-		return;
-	}
-}
 function expiryOf(session) {
 	if (typeof session.expires_at === "number") return session.expires_at;
-	const exp = decodePayload(session.access_token)?.["exp"];
+	const exp = decodeJwtPayload(session.access_token)?.["exp"];
 	return typeof exp === "number" ? exp : void 0;
 }
 function serverEnv(options) {
@@ -275,7 +324,13 @@ async function verify(credentials, modes, options, source) {
 }
 /** Validates a user's claims against `options.claims`, keeping every JWT claim. */
 async function checkClaims(state, options) {
-	if (state.kind !== "user" || !options.claims) return state;
+	if (state.kind !== "user") return state;
+	if (!actorOf(state.claims).ok) return {
+		kind: "invalid",
+		reason: "actor",
+		error: dbError("unauthorized", "The token's act claim is not a chain of actors with a sub", { code: "ACTOR_INVALID" })
+	};
+	if (!options.claims) return state;
 	let outcome = options.claims["~standard"].validate(state.claims);
 	if (outcome instanceof Promise) outcome = await outcome;
 	if (outcome.issues) {
@@ -321,8 +376,8 @@ async function verifyOnce(credentials, modes, options, source) {
 	const { data, error } = await verifyCredentials(credentials, {
 		auth: modes,
 		env: serverEnv(options),
-		...options.audience !== void 0 ? { audience: options.audience } : {},
-		...options.issuer !== void 0 ? { issuer: options.issuer } : {}
+		...options.audience === void 0 ? {} : { audience: options.audience },
+		...options.issuer === void 0 ? {} : { issuer: options.issuer }
 	});
 	if (error) {
 		const kind = error.code === "JWKS_FETCH_FAILED" ? "network" : error.status >= 500 ? "unexpected" : "unauthorized";
@@ -421,7 +476,7 @@ async function resolveAuth(request, options) {
 			token: session.access_token,
 			apikey: null
 		}, ["user"], options, "cookie");
-		if (state.kind !== "invalid" || state.reason === "claims" || state.error.kind === "network") return resolution(state, cookies);
+		if (state.kind !== "invalid" || state.reason !== "token" || state.error.kind === "network") return resolution(state, cookies);
 		if (!options.refresh) return resolution({
 			kind: "anon",
 			reason: "signed_out"
@@ -473,8 +528,8 @@ function authContext(auth) {
 				actor: {
 					id: auth.user.id,
 					kind: "user",
-					...auth.user.role !== void 0 ? { role: auth.user.role } : {},
-					...auth.user.email !== void 0 ? { email: auth.user.email } : {},
+					...auth.user.role === void 0 ? {} : { role: auth.user.role },
+					...auth.user.email === void 0 ? {} : { email: auth.user.email },
 					...impersonator ? { impersonator: impersonator.id } : {}
 				},
 				claims: auth.claims
@@ -538,4 +593,4 @@ function checkAal(auth, required) {
 	});
 }
 //#endregion
-export { clientIp as a, applyCookieWrites as c, serializeCookie as d, sessionCookieName as f, impersonatorOf as g, actClaim as h, authContext as i, parseCookies as l, refreshSession as m, amrOf as n, resolveAuth as o, writeSession as p, checkAal as r, AUTH_CACHE_HEADERS as s, aalOf as t, readSession as u };
+export { actClaim as _, clientIp as a, applyCookieWrites as c, serializeCookie as d, sessionCookieName as f, delegationOf as g, actorOf as h, authContext as i, parseCookies as l, refreshSession as m, amrOf as n, resolveAuth as o, writeSession as p, checkAal as r, AUTH_CACHE_HEADERS as s, aalOf as t, readSession as u, impersonatorOf as v };

package/dist/{mfa-TVia554c.d.ts → mfa-x3V3vGh-.d.ts}

@@ -1,4 +1,4 @@
-import { p as DbError } from "./result-CTkCZ6JA.js";
+import { p as DbError } from "./result-c2OYgCV2.js";
 //#region src/auth/impersonation.d.ts
 /** The admin acting as the user, from the RFC 8693 `act` claim. */
 interface Impersonator {

package/dist/next/index.d.ts

@@ -1,12 +1,12 @@
-import { n as AnyModels, t as AnyFunctions } from "../types-C83v5SQz.js";
-import { p as DbError } from "../result-CTkCZ6JA.js";
-import { B as ReadSet, P as DbStats, Z as QuerySpec, l as CacheAdapter, t as BetterSupabase } from "../define-e3zI4_4g.js";
-import { n as AmrEntry, s as Impersonator, t as Aal } from "../mfa-TVia554c.js";
-import { r as AuthState } from "../resolve-CjHILk2w.js";
-import { d as ServerContext, f as ServerOptions, l as BetterServer, n as GuardOptions, t as AuthKind } from "../respond-Dne1ARSa.js";
-import { n as toSession, t as AuthSession } from "../view-D1s0wa0T.js";
-import { r as LiveCountSeed, t as CountRunner } from "../live-DJyZMD6w.js";
-import { n as MembershipClaim, r as hasEntitlement, t as EntitlementKey } from "../entitlements-Dng-ctuT.js";
+import { n as AnyModels, t as AnyFunctions } from "../types-DONv9SHN.js";
+import { p as DbError } from "../result-c2OYgCV2.js";
+import { B as ReadSet, P as DbStats, Z as QuerySpec, l as CacheAdapter, t as BetterSupabase } from "../define-DUbydmJa.js";
+import { n as AmrEntry, s as Impersonator, t as Aal } from "../mfa-x3V3vGh-.js";
+import { r as AuthState } from "../resolve-BRciX2jK.js";
+import { d as ServerContext, f as ServerOptions, l as BetterServer, n as GuardOptions, t as AuthKind } from "../respond-DAkPIdTH.js";
+import { n as toSession, t as AuthSession } from "../view-3Po_PVlr.js";
+import { r as LiveCountSeed, t as CountRunner } from "../live-QE3UPbGm.js";
+import { n as MembershipClaim, r as hasEntitlement, t as EntitlementKey } from "../entitlements-DvJXoI02.js";
 import { NextRequest } from "next/server.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/next/collector.d.ts
@@ -17,8 +17,8 @@ interface DbBudget {
   readonly waves?: number;
 }
 //#endregion
-//#region src/next/index.d.ts
-export interface NextOptions extends ServerOptions {
+//#region src/next/create.d.ts
+interface NextOptions extends ServerOptions {
   /** Invalidate `tagFor(table)` cache tags after mutations. Defaults to true. */
   readonly cacheTags?: boolean;
   /** Include internal error messages in Problem Details. Defaults to development only. */
@@ -26,7 +26,7 @@ export interface NextOptions extends ServerOptions {
   /** Per-request database call counts. See the Budget docs. */
   readonly debug?: NextDebugOptions;
 }
-export interface NextDebugOptions {
+interface NextDebugOptions {
   /** Collect outside development too, e.g. for e2e runs against `next start`. */
   readonly enabled?: boolean;
   /** Header with `calls;waves;ms` on route handler responses. Defaults to `x-bs-db-calls`. */
@@ -38,7 +38,7 @@ export interface NextDebugOptions {
 }
 /** Response header with the URL of the request's totals on `next.debugRoute()`. */
 export declare const STATS_URL_HEADER = "x-bs-stats";
-export interface ProxyOptions<C = unknown, U = unknown> {
+interface ProxyOptions<C = unknown, U = unknown> {
   /**
    * Another middleware to compose with, such as next-intl's. It runs on the
    * original request, alongside auth; its rewrite, redirect or request
@@ -55,7 +55,7 @@ export interface ProxyOptions<C = unknown, U = unknown> {
    */
   readonly serverTiming?: boolean;
 }
-export type ActionResult<T> = {
+type ActionResult<T> = {
   readonly ok: true;
   readonly data: T;
   readonly error: null;
@@ -64,7 +64,7 @@ export type ActionResult<T> = {
   readonly data: null;
   readonly error: DbError;
 };
-export interface ActionOptions<S extends StandardSchemaV1 | undefined> extends GuardOptions {
+interface ActionOptions<S extends StandardSchemaV1 | undefined> extends GuardOptions {
   /** Validates the input (plain object or `FormData`) with any Standard Schema. */
   readonly input?: S;
 }
@@ -76,7 +76,7 @@ type Unwrapped<T> = T extends {
 } | {
   readonly ok: false;
 } ? D : T;
-export interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown, U = unknown> extends BetterServer<M, F, E, C, U> {
+interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown, U = unknown> extends BetterServer<M, F, E, C, U> {
   /** `proxy.ts`: refreshes sessions for page loads and server actions. */
   proxy(request: NextRequest, options?: ProxyOptions<C, U>): Promise<Response>;
   /** Server Components and actions: the caller's context, memoized per request. */
@@ -97,8 +97,9 @@ export interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C =
   }): Promise<ServerContext<M, F, E, C, U>>;
   /**
    * First statement of an app-authored `'use cache: private'` function: sets
-   * `cacheLife` from the session's expiry (`sessionStale`), tags the entry
-   * `bs:session:<user id>` and returns the caller's context plus `session`.
+   * `cacheLife` from the session's expiry (`sessionStale`, capped by
+   * `life.stale`), tags the entry `bs:session:<user id>` plus `tags`, and
+   * returns the caller's context plus `session`.
    *
    * ```ts
    * async function getCustomers() {
@@ -109,8 +110,13 @@ export interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C =
    * ```
    */
   cached(options?: CachedOptions): Promise<CachedContext<M, F, E, C, U>>;
-  /** Drops every `next.cached()` entry of a user, e.g. after a role change. */
-  invalidateSession(userId: string): void;
+  /**
+   * Drops every `next.cached()` entry of a user, e.g. after a role change,
+   * and the entries tagged with `tags` (such as PermDock's `snapshotTag(userId)`).
+   */
+  invalidateSession(userId: string, options?: {
+    readonly tags?: readonly string[];
+  }): void;
   /**
    * Counts on the server and returns a serializable seed for
    * `useLiveCount(seed)`, so the badge renders with a number and the client
@@ -141,7 +147,7 @@ export interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C =
    */
   debugRoute(): (request: Request) => Promise<Response>;
 }
-export interface SessionStaleOptions {
+interface SessionStaleOptions {
   /** Below this, the result would not be prefetched anyway. Defaults to 30. */
   readonly min?: number;
   /** 300 (5 minutes) joins the route's App Shell. Defaults to 300. */
@@ -152,14 +158,21 @@ export interface SessionStaleOptions {
  * the token's expiry, and at least `min`.
  */
 export declare function sessionStale(session: AuthSession, options?: SessionStaleOptions, now?: number): number;
-export interface CachedOptions {
-  /** `cacheLife` for the entry. `stale` comes from `sessionStale`. */
+interface CachedOptions {
+  /**
+   * `cacheLife` for the entry. `stale` is `sessionStale`, and never more than
+   * `stale` when it is set: pass PermDock's `cacheLifeFor(snapshot)` so the
+   * entry goes stale with the snapshot too.
+   */
   readonly life?: SessionStaleOptions & {
+    readonly stale?: number;
     readonly revalidate?: number;
     readonly expire?: number;
   };
+  /** More `cacheTag`s for the entry, e.g. `snapshotTag(sub)` or `org:<id>`. */
+  readonly tags?: readonly string[];
 }
-export type CachedContext<M extends AnyModels, F extends AnyFunctions, E, C = unknown, U = unknown> = ServerContext<M, F, E, C, U> & {
+type CachedContext<M extends AnyModels, F extends AnyFunctions, E, C = unknown, U = unknown> = ServerContext<M, F, E, C, U> & {
   readonly session: AuthSession<C, U>;
 };
 /** The tag `next.cached()` puts on a user's entries. */
@@ -172,7 +185,7 @@ export declare function tagFor(table: string, id?: string | number): string;
  * `cacheTags: false`.
  */
 export declare function nextCache(): CacheAdapter;
-export interface RequireAalOptions {
+interface RequireAalOptions {
   /**
    * Page that enrolls or challenges a second factor. Signed-in users below
    * the level are redirected there with `?next=<path>`; without it they get
@@ -207,4 +220,4 @@ export declare function shouldRefresh(request: Request): boolean;
  */
 export declare function createNext<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, U = unknown>(sb: BetterSupabase<M, D, F, E, C, U>, options?: NextOptions): BetterNext<M, F, E, C, U>;
 //#endregion
-export { type Aal, type AmrEntry, type AuthKind, type AuthSession, type DbBudget, type DbStats, type EntitlementKey, type GuardOptions, type Impersonator, type MembershipClaim, hasEntitlement, toSession };
+export { type Aal, type ActionOptions, type ActionResult, type AmrEntry, type AuthKind, type AuthSession, type BetterNext, type CachedContext, type CachedOptions, type DbBudget, type DbStats, type EntitlementKey, type GuardOptions, type Impersonator, type MembershipClaim, type NextDebugOptions, type NextOptions, type ProxyOptions, type RequireAalOptions, type SessionStaleOptions, hasEntitlement, toSession };

package/dist/next/index.js

@@ -1,13 +1,13 @@
 import { n as dbError } from "../errors-Bl3rkOzo.js";
-import { n as StatsRecorder, t as EMPTY_STATS } from "../stats-C5W-rBfR.js";
-import { o as isReadSet } from "../read-set-4lI3W_gZ.js";
+import { n as StatsRecorder, t as EMPTY_STATS } from "../stats-D78UQ8Yu.js";
+import { o as isReadSet } from "../read-set-D0qBcboM.js";
 import { t as validate } from "../standard-FUi3Z3-7.js";
-import { a as problemResponse } from "../problem-BTkTtRV9.js";
+import { a as problemResponse } from "../problem-CGt1ADix.js";
 import { t as isList } from "../guards-BnzDvFrz.js";
 import { t as hasEntitlement } from "../entitlements-CTEBm7IB.js";
-import { a as settle, c as withExtra, d as primaryCookie, i as respond, n as guard, o as createServer, s as extendServer, t as defaultExpose, u as PRIMARY_COOKIE } from "../respond-DMcbQwfN.js";
-import { r as checkAal } from "../mfa-CpLfJSde.js";
-import { t as toSession } from "../view-aOYizTeE.js";
+import { a as settle, c as withExtra, d as primaryCookie, i as respond, n as guard, o as createServer, s as extendServer, t as defaultExpose, u as PRIMARY_COOKIE } from "../respond-C44EZAJo.js";
+import { r as checkAal } from "../mfa-BxoR1RkN.js";
+import { t as toSession } from "../view-wZ-9qIUz.js";
 import { cache } from "react";
 import { cacheLife, cacheTag, revalidateTag, updateTag } from "next/cache.js";
 import { cookies, headers } from "next/headers.js";
@@ -43,7 +43,9 @@ var StatsCollector = class {
 		this.#prune();
 		const entry = {
 			created: Date.now(),
-			recorder: new CollectedRecorder(() => this.#schedule(id))
+			recorder: new CollectedRecorder(() => {
+				this.#schedule(id);
+			})
 		};
 		this.#entries.set(id, entry);
 		return entry.recorder;
@@ -140,7 +142,7 @@ function serverTimingValue(metrics) {
 	return Object.entries(metrics).map(([name, ms]) => `${name};dur=${ms.toFixed(1)}`).join(", ");
 }
 //#endregion
-//#region src/next/index.ts
+//#region src/next/create.ts
 /** Response header with the URL of the request's totals on `next.debugRoute()`. */
 const STATS_URL_HEADER = "x-bs-stats";
 /**
@@ -208,10 +210,10 @@ function formDataObject(form) {
 function requireAal(level, options = {}) {
 	return (auth, request) => {
 		const { pathname, search } = request.nextUrl;
-		if (options.redirect !== void 0 && pathname === options.redirect) return void 0;
-		if (options.match && !options.match(pathname)) return void 0;
+		if (options.redirect !== void 0 && pathname === options.redirect) return;
+		if (options.match && !options.match(pathname)) return;
 		const denied = checkAal(auth, level);
-		if (!denied) return void 0;
+		if (!denied) return;
 		if (options.redirect === void 0) return problemResponse(denied);
 		const target = new URL(options.redirect, request.url);
 		target.searchParams.set("next", `${pathname}${search}`);
@@ -244,8 +246,8 @@ function createNext(sb, options = {}) {
 	const debug = options.debug;
 	const statsHeader = debug?.header ?? "x-bs-db-calls";
 	const statsRoute = debug?.route ?? "/api/bs-stats";
-	const development = typeof process !== "undefined" && process.env["NODE_ENV"] === "development";
-	const collector = debug && (debug.enabled ?? development) ? sharedCollector({
+	const development = process.env["NODE_ENV"] === "development";
+	const collector = debug?.enabled ? sharedCollector({
 		logger: sb.events.logger,
 		warn: development,
 		...debug.budget ? { budget: debug.budget } : {}
@@ -284,16 +286,19 @@ function createNext(sb, options = {}) {
 		async cached(cachedOptions = {}) {
 			const [view, ctx] = await Promise.all([session(), server()]);
 			const life = cachedOptions.life;
+			const stale = sessionStale(view, life);
 			cacheLife({
-				stale: sessionStale(view, life),
+				stale: life?.stale === void 0 ? stale : Math.min(stale, life.stale),
 				...life?.revalidate === void 0 ? {} : { revalidate: life.revalidate },
 				...life?.expire === void 0 ? {} : { expire: life.expire }
 			});
-			if (view.kind === "user") cacheTag(sessionTag(view.user.id));
+			const tags = [...view.kind === "user" ? [sessionTag(view.user.id)] : [], ...cachedOptions.tags ?? []];
+			if (tags.length > 0) cacheTag(...tags);
 			return withExtra(ctx, { session: view });
 		},
-		invalidateSession(userId) {
+		invalidateSession(userId, invalidateOptions = {}) {
 			invalidate(sessionTag(userId));
+			for (const tag of invalidateOptions.tags ?? []) invalidate(tag);
 		},
 		async liveCount(spec, db) {
 			const result = await (db ?? (await server()).db).$run(spec);
@@ -337,7 +342,7 @@ function createNext(sb, options = {}) {
 		route(handler, guardOptions = {}) {
 			return async (request, segment) => {
 				const ctx = await base.context(request, statsFor(request));
-				const denied = guard(ctx.auth, guardOptions.allow, guardOptions.aal);
+				const denied = guard(ctx.auth, guardOptions.allow, guardOptions.aal, guardOptions.scopes);
 				const instance = request.nextUrl.pathname;
 				if (denied) return problemResponse(denied, {
 					instance,
@@ -358,23 +363,23 @@ function createNext(sb, options = {}) {
 			};
 		},
 		debugRoute() {
-			return async (request) => {
+			return (request) => {
 				const id = new URL(request.url).searchParams.get("id");
-				if (!collector || !id) return Response.json({ error: collector ? "missing ?id=" : "debug is off" }, {
+				if (!collector || !id) return Promise.resolve(Response.json({ error: collector ? "missing ?id=" : "debug is off" }, {
 					status: 404,
 					headers: { "cache-control": "no-store" }
-				});
+				}));
 				const stats = collector.get(id) ?? EMPTY_STATS;
-				return Response.json(stats, { headers: {
+				return Promise.resolve(Response.json(stats, { headers: {
 					[statsHeader]: formatStats(stats),
 					"cache-control": "no-store"
-				} });
+				} }));
 			};
 		},
 		action(actionOptions, fn) {
 			return async (input) => {
 				const ctx = await server();
-				const denied = guard(ctx.auth, actionOptions.allow, actionOptions.aal);
+				const denied = guard(ctx.auth, actionOptions.allow, actionOptions.aal, actionOptions.scopes);
 				if (denied) return {
 					ok: false,
 					data: null,

package/dist/openapi/index.d.ts

@@ -1,2 +1,2 @@
-import { a as ResourceOptions, i as ResourceOperation, n as OpenApiOptions, o as createOpenApi, r as PROBLEM_SCHEMA, t as OpenApiDocument } from "../index-DbxFr7XG.js";
+import { a as ResourceOptions, i as ResourceOperation, n as OpenApiOptions, o as createOpenApi, r as PROBLEM_SCHEMA, t as OpenApiDocument } from "../index-qriRM9cZ.js";
 export { OpenApiDocument, OpenApiOptions, PROBLEM_SCHEMA, ResourceOperation, ResourceOptions, createOpenApi };

package/dist/openapi/index.js

@@ -1,6 +1,6 @@
-import { n as PROBLEM_TYPE_BASE, t as PROBLEM_CONTENT_TYPE } from "../problem-BTkTtRV9.js";
+import { n as PROBLEM_TYPE_BASE, t as PROBLEM_CONTENT_TYPE } from "../problem-CGt1ADix.js";
 import { t as SPEC_PINS } from "../spec-pins-C3oc-Tdp.js";
-import { t as buildJsonSchema } from "../json-schema-BpYqkCKf.js";
+import { t as buildJsonSchema } from "../json-schema--aOXAGfU.js";
 //#region src/openapi/index.ts
 /** JSON Schema for RFC 9457 Problem Details as better-supabase sends them. */
 const PROBLEM_SCHEMA = {
@@ -81,7 +81,7 @@ const ERRORS = [
 		"Validation or a check constraint failed."
 	]
 ];
-const pascal = (value) => value.replace(/(^|[_-])(\w)/g, (_, _sep, char) => char.toUpperCase());
+const pascal = (value) => value.replaceAll(/(^|[_-])(\w)/g, (_, _sep, char) => char.toUpperCase());
 const ref = (name) => ({ $ref: `#/components/schemas/${name}` });
 const response = (name) => ({ $ref: `#/components/responses/${name}` });
 function errorResponses(codes) {
@@ -95,8 +95,14 @@ function jsonBody(schema, description) {
 		content: { "application/json": { schema } }
 	};
 }
-function pageParameters() {
-	return [{
+function pageParameters(cursor, maxPageSize) {
+	return [cursor ? {
+		name: "after",
+		in: "query",
+		required: false,
+		description: "`nextCursor` of the previous page. Leave it out for the first page.",
+		schema: { type: "string" }
+	} : {
 		name: "page",
 		in: "query",
 		required: false,
@@ -114,11 +120,53 @@ function pageParameters() {
 		schema: {
 			type: "integer",
 			minimum: 1,
-			maximum: 200,
+			maximum: maxPageSize,
 			default: 50
 		}
 	}];
 }
+function pageSchema(row, cursor) {
+	const items = {
+		type: "array",
+		items: row
+	};
+	return cursor ? {
+		type: "object",
+		required: [
+			"items",
+			"nextCursor",
+			"hasMore"
+		],
+		properties: {
+			items,
+			nextCursor: { type: ["string", "null"] },
+			hasMore: { type: "boolean" }
+		}
+	} : {
+		type: "object",
+		required: ["items", "page"],
+		properties: {
+			items,
+			page: {
+				type: "object",
+				required: [
+					"number",
+					"size",
+					"total",
+					"pages",
+					"hasMore"
+				],
+				properties: {
+					number: { type: "integer" },
+					size: { type: "integer" },
+					total: { type: ["integer", "null"] },
+					pages: { type: ["integer", "null"] },
+					hasMore: { type: "boolean" }
+				}
+			}
+		}
+	};
+}
 /**
 * An OpenAPI 3.1 document for REST resources over your tables, with schemas
 * from the generated metadata, list-query parameters, Supabase security
@@ -167,33 +215,8 @@ function createOpenApi(sb, options) {
 			const schema = defs[`${key}${variant}`];
 			if (schema) schemas[`${name}${variant}`] = schema;
 		}
-		schemas[`${name}Page`] = {
-			type: "object",
-			required: ["items", "page"],
-			properties: {
-				items: {
-					type: "array",
-					items: ref(`${name}Row`)
-				},
-				page: {
-					type: "object",
-					required: [
-						"number",
-						"size",
-						"total",
-						"pages",
-						"hasMore"
-					],
-					properties: {
-						number: { type: "integer" },
-						size: { type: "integer" },
-						total: { type: ["integer", "null"] },
-						pages: { type: ["integer", "null"] },
-						hasMore: { type: "boolean" }
-					}
-				}
-			}
-		};
+		const cursor = (resource.list ? resource.list.pagination : resource.pagination) === "cursor";
+		schemas[`${name}Page`] = pageSchema(ref(`${name}Row`), cursor);
 		const collection = `${base}${resource.path ?? `/${key}`}`;
 		const keyColumn = table.primaryKey.length === 1 ? table.primaryKey[0] : void 0;
 		const idSchema = keyColumn ? (defs[`${key}Row`]?.["properties"])?.[keyColumn] ?? { type: "string" } : void 0;
@@ -215,7 +238,7 @@ function createOpenApi(sb, options) {
 		for (const operation of operations) switch (operation) {
 			case "list":
 				(paths[collection] ??= {})["get"] = op("list", `List ${key}`, {
-					parameters: resource.list?.openapi ?? pageParameters(),
+					parameters: resource.list?.openapi ?? pageParameters(cursor, resource.maxPageSize ?? 200),
 					responses: {
 						"200": jsonBody(ref(`${name}Page`), `A page of ${key}.`),
 						...errorResponses([

package/dist/orpc/index.d.ts

@@ -1,9 +1,9 @@
-import { n as AnyModels, t as AnyFunctions } from "../types-C83v5SQz.js";
-import { o as Result, p as DbError } from "../result-CTkCZ6JA.js";
-import { t as BetterSupabase } from "../define-e3zI4_4g.js";
-import { r as AuthState } from "../resolve-CjHILk2w.js";
-import { d as ServerContext, f as ServerOptions, l as BetterServer, n as GuardOptions } from "../respond-Dne1ARSa.js";
-import { r as ProblemDetails } from "../problem-DlgB0lYl.js";
+import { n as AnyModels, t as AnyFunctions } from "../types-DONv9SHN.js";
+import { o as Result, p as DbError } from "../result-c2OYgCV2.js";
+import { t as BetterSupabase } from "../define-DUbydmJa.js";
+import { r as AuthState } from "../resolve-BRciX2jK.js";
+import { d as ServerContext, f as ServerOptions, l as BetterServer, n as GuardOptions } from "../respond-DAkPIdTH.js";
+import { r as ProblemDetails } from "../problem-Z2RTQjZD.js";
 import { DecoratedMiddleware, ORPCError } from "@orpc/server";
 //#region src/orpc/index.d.ts
 /** Initial context: pass `{ context: { request } }` to the oRPC handler. */

package/dist/orpc/index.js

@@ -1,6 +1,6 @@
 import { r as dbErrorOf } from "../errors-Bl3rkOzo.js";
-import { o as toProblem } from "../problem-BTkTtRV9.js";
-import { a as settle, n as guard, o as createServer, s as extendServer, t as defaultExpose } from "../respond-DMcbQwfN.js";
+import { o as toProblem } from "../problem-CGt1ADix.js";
+import { a as settle, n as guard, o as createServer, s as extendServer, t as defaultExpose } from "../respond-C44EZAJo.js";
 import { COMMON_ERROR_STATUS_MAP, ORPCError, os } from "@orpc/server";
 //#region src/orpc/index.ts
 const CODES = new Map(Object.entries(COMMON_ERROR_STATUS_MAP).map(([code, status]) => [status, code]));
@@ -24,7 +24,7 @@ function createOrpc(sb, options = {}) {
 		middleware(middlewareOptions = {}) {
 			return os.$context().middleware(async ({ context, next }) => {
 				const ctx = await server.context(context.request, { refresh: middlewareOptions.refresh ?? false });
-				const denied = guard(ctx.auth, middlewareOptions.allow, middlewareOptions.aal);
+				const denied = guard(ctx.auth, middlewareOptions.allow, middlewareOptions.aal, middlewareOptions.scopes);
 				if (denied) throw toORPCError(denied);
 				try {
 					return await next({ context: {

package/dist/otel/index.d.ts

@@ -1,5 +1,5 @@
-import { a as EventHub } from "../events-DOt3nSO-.js";
-import { f as Plugin } from "../plugin-C4TR9J0Z.js";
+import { a as EventHub } from "../events-Do8jXh4D.js";
+import { f as Plugin } from "../plugin-DVRB8qNE.js";
 import { t as SPEC_PINS } from "../spec-pins-CqorWDnO.js";
 import { Attributes, Meter, Tracer } from "@opentelemetry/api";
 //#region src/otel/index.d.ts

package/dist/otel/index.js

@@ -1,6 +1,6 @@
 import { n as definePlugin } from "../plugin-BqR6wKMB.js";
 import { t as SPEC_PINS } from "../spec-pins-C3oc-Tdp.js";
-import "../version-Cqq1m3UY.js";
+import "../version-BfpG2gks.js";
 import { SpanKind, SpanStatusCode, context, metrics, propagation, trace } from "@opentelemetry/api";
 //#region src/otel/index.ts
 const INSTRUMENTATION_NAME = "better-supabase";
@@ -157,7 +157,9 @@ function traceAuth(sb, options = {}) {
 function tracedFetch(base = fetch) {
 	return (input, init) => {
 		const headers = new Headers(init?.headers ?? (input instanceof Request ? input.headers : void 0));
-		propagation.inject(context.active(), headers, { set: (carrier, key, value) => carrier.set(key, value) });
+		propagation.inject(context.active(), headers, { set: (carrier, key, value) => {
+			carrier.set(key, value);
+		} });
 		return base(input, {
 			...init,
 			headers