better-supabase 0.3.0 → 0.4.0

package/dist/openapi/index.js

@@ -1,6 +1,6 @@
-import { n as PROBLEM_TYPE_BASE, t as PROBLEM_CONTENT_TYPE } from "../problem-CGt1ADix.js";
+import { n as PROBLEM_TYPE_BASE, t as PROBLEM_CONTENT_TYPE } from "../problem-BihjPR0t.js";
 import { t as SPEC_PINS } from "../spec-pins-C3oc-Tdp.js";
-import { t as buildJsonSchema } from "../json-schema--aOXAGfU.js";
+import { t as buildJsonSchema } from "../json-schema-DP6V7cbr.js";
 //#region src/openapi/index.ts
 /** JSON Schema for RFC 9457 Problem Details as better-supabase sends them. */
 const PROBLEM_SCHEMA = {
@@ -173,15 +173,15 @@ function pageSchema(row, cursor) {
 * schemes and Problem Details errors.
 *
 * ```ts
-* const doc = createOpenApi(sb, {
+* const doc = createOpenApi(betterSupabase, {
 *   info: { title: 'CRM API', version: '1.0.0' },
 *   resources: { customers: { list: customerList }, notes: { operations: ['list', 'get'] } },
 * });
 * ```
 */
-function createOpenApi(sb, options) {
+function createOpenApi(betterSupabase, options) {
 	const defs = buildJsonSchema({
-		meta: sb.meta,
+		meta: betterSupabase.meta,
 		config: { json: options.json ?? {} }
 	})["$defs"];
 	const schemas = { Problem: PROBLEM_SCHEMA };
@@ -190,7 +190,7 @@ function createOpenApi(sb, options) {
 	const base = (options.basePath ?? "").replace(/\/$/, "");
 	const security = options.security ?? ["bearer"];
 	for (const [key, raw] of Object.entries(options.resources)) {
-		const table = sb.meta.tables[key];
+		const table = betterSupabase.meta.tables[key];
 		if (!table) throw new TypeError(`createOpenApi: unknown table "${key}"`);
 		const resource = raw === true ? {} : raw;
 		const operations = resource.operations ?? (table.kind === "view" ? ["list", "get"] : [

package/dist/orpc/index.d.ts

@@ -1,9 +1,9 @@
 import { n as AnyModels, t as AnyFunctions } from "../types-DONv9SHN.js";
-import { o as Result, p as DbError } from "../result-c2OYgCV2.js";
-import { t as BetterSupabase } from "../define-DUbydmJa.js";
-import { r as AuthState } from "../resolve-BRciX2jK.js";
-import { d as ServerContext, f as ServerOptions, l as BetterServer, n as GuardOptions } from "../respond-DAkPIdTH.js";
-import { r as ProblemDetails } from "../problem-Z2RTQjZD.js";
+import { o as Result, p as DbError } from "../result-CqEsbgYs.js";
+import { t as BetterSupabase } from "../define-CRS2MRV3.js";
+import { r as AuthState } from "../resolve-BAqQcwMW.js";
+import { f as ServerContext, n as GuardOptions, p as ServerOptions, r as MiddlewareOptions, u as BetterServer } from "../respond-DgIbdrt8.js";
+import { r as ProblemDetails } from "../problem-U8UEKccv.js";
 import { DecoratedMiddleware, ORPCError } from "@orpc/server";
 //#region src/orpc/index.d.ts
 /** Initial context: pass `{ context: { request } }` to the oRPC handler. */
@@ -11,36 +11,33 @@ export interface OrpcRequestContext {
   readonly request: Request;
 }
 /** What `middleware()` adds to `context`. */
-export interface OrpcContext<M extends AnyModels, F extends AnyFunctions, E> {
-  readonly bs: ServerContext<M, F, E>;
-  readonly db: ServerContext<M, F, E>["db"];
-  readonly auth: AuthState;
+export interface OrpcContext<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> {
+  readonly bs: ServerContext<M, F, E, C, P>;
+  readonly db: ServerContext<M, F, E, C, P>["db"];
+  readonly auth: AuthState<C, P>;
 }
 export interface OrpcOptions extends ServerOptions {
   /** Include internal error messages. Defaults to `NODE_ENV === 'development'`. */
   readonly exposeErrors?: boolean;
 }
-export interface MiddlewareOptions extends GuardOptions {
-  /** Refresh an expired cookie session. Pair with `ctx.bs.resolution.apply` in the handler adapter. */
-  readonly refresh?: boolean;
-}
-export type OrpcMiddleware<M extends AnyModels, F extends AnyFunctions, E> = DecoratedMiddleware<OrpcRequestContext, OrpcContext<M, F, E>, unknown, unknown, Record<never, never>>;
-export interface BetterOrpc<M extends AnyModels, F extends AnyFunctions, E> extends BetterServer<M, F, E> {
+export type OrpcMiddleware<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> = DecoratedMiddleware<OrpcRequestContext, OrpcContext<M, F, E, C, P>, unknown, unknown, Record<never, never>>;
+export interface BetterOrpc<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> extends BetterServer<M, F, E, C, P> {
   /**
    * Resolves the caller, enforces `allow` and adds `context.db`, `context.auth`
    * and `context.bs`. Thrown `DbException`s, and errors caused by a
-   * `DbError`, become `ORPCError`s.
+   * `DbError`, become `ORPCError`s. With `refresh`, pair it with
+   * `ctx.bs.resolution.apply` in the handler adapter.
    */
-  middleware(options?: MiddlewareOptions): OrpcMiddleware<M, F, E>;
+  middleware(options?: MiddlewareOptions): OrpcMiddleware<M, F, E, C, P>;
   /** A `Result` (or `AsyncResult`) as data, throwing an `ORPCError` on failure. */
   unwrap<T>(value: Result<T> | PromiseLike<Result<T>>): Promise<T>;
   /** Plain values pass through; thrown `DbException`s become `ORPCError`s. */
   unwrap<T>(value: T | PromiseLike<T>): Promise<T>;
-  toORPCError(error: DbError): ORPCError<string, ProblemDetails>;
+  toOrpcError(error: DbError): ORPCError<string, ProblemDetails>;
 }
 /** oRPC code for a `DbError`, from its HTTP status. */
 export declare function orpcCode(error: DbError): string;
 /** oRPC integration: middleware adding the caller's repositories to `context`. */
-export declare function createOrpc<M extends AnyModels, D, F extends AnyFunctions, E>(sb: BetterSupabase<M, D, F, E>, options?: OrpcOptions): BetterOrpc<M, F, E>;
+export declare function createOrpc<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown>(betterSupabase: BetterSupabase<M, D, F, E, C, P>, options?: OrpcOptions): BetterOrpc<M, F, E, C, P>;
 //#endregion
-export type { GuardOptions };
+export type { GuardOptions, MiddlewareOptions };

package/dist/orpc/index.js

@@ -1,18 +1,18 @@
-import { r as dbErrorOf } from "../errors-Bl3rkOzo.js";
-import { o as toProblem } from "../problem-CGt1ADix.js";
-import { a as settle, n as guard, o as createServer, s as extendServer, t as defaultExpose } from "../respond-C44EZAJo.js";
+import { r as dbErrorOf } from "../errors-L0xK41y_.js";
+import { o as toProblem } from "../problem-BihjPR0t.js";
+import { a as guard, c as settle, i as defaultExpose, n as extendServer, t as createServer } from "../server-BA75B0mT.js";
 import { COMMON_ERROR_STATUS_MAP, ORPCError, os } from "@orpc/server";
 //#region src/orpc/index.ts
-const CODES = new Map(Object.entries(COMMON_ERROR_STATUS_MAP).map(([code, status]) => [status, code]));
+const CODES = /* @__PURE__ */ new Map(Object.entries(COMMON_ERROR_STATUS_MAP).map(([code, status]) => [status, code]));
 /** oRPC code for a `DbError`, from its HTTP status. */
 function orpcCode(error) {
 	return CODES.get(error.status) ?? (error.status >= 500 ? "INTERNAL_SERVER_ERROR" : "BAD_REQUEST");
 }
 /** oRPC integration: middleware adding the caller's repositories to `context`. */
-function createOrpc(sb, options = {}) {
-	const server = createServer(sb, options);
+function createOrpc(betterSupabase, options = {}) {
+	const server = createServer(betterSupabase, options);
 	const expose = options.exposeErrors ?? defaultExpose();
-	const toORPCError = (error) => {
+	const toOrpcError = (error) => {
 		const problem = toProblem(error, { expose });
 		return new ORPCError(orpcCode(error), {
 			message: problem.detail ?? problem.title,
@@ -20,12 +20,12 @@ function createOrpc(sb, options = {}) {
 		});
 	};
 	return extendServer(server, {
-		toORPCError,
+		toOrpcError,
 		middleware(middlewareOptions = {}) {
 			return os.$context().middleware(async ({ context, next }) => {
 				const ctx = await server.context(context.request, { refresh: middlewareOptions.refresh ?? false });
 				const denied = guard(ctx.auth, middlewareOptions.allow, middlewareOptions.aal, middlewareOptions.scopes);
-				if (denied) throw toORPCError(denied);
+				if (denied) throw toOrpcError(denied);
 				try {
 					return await next({ context: {
 						bs: ctx,
@@ -34,14 +34,14 @@ function createOrpc(sb, options = {}) {
 					} });
 				} catch (cause) {
 					const thrown = dbErrorOf(cause);
-					if (thrown) throw toORPCError(thrown);
+					if (thrown) throw toOrpcError(thrown);
 					throw cause;
 				}
 			});
 		},
 		async unwrap(value) {
 			const settled = await settle(() => value);
-			if (!settled.ok) throw toORPCError(settled.error);
+			if (!settled.ok) throw toOrpcError(settled.error);
 			return settled.data;
 		}
 	});

package/dist/otel/index.d.ts

@@ -1,5 +1,5 @@
-import { a as EventHub } from "../events-Do8jXh4D.js";
-import { f as Plugin } from "../plugin-DVRB8qNE.js";
+import { a as EventHub } from "../events-B21UOhvP.js";
+import { f as Plugin } from "../plugin-bNhvJwRh.js";
 import { t as SPEC_PINS } from "../spec-pins-CqorWDnO.js";
 import { Attributes, Meter, Tracer } from "@opentelemetry/api";
 //#region src/otel/index.d.ts
@@ -20,15 +20,15 @@ export interface OtelOptions {
  * never recorded; `db.query.summary` is `SELECT customers`.
  *
  * ```ts
- * const sb = defineSupabase(schema).use(otel());
+ * const betterSupabase = defineSupabase(schema).use(otel());
  * ```
  */
 export declare function otel(options?: OtelOptions): Plugin<"otel">;
 /**
- * Spans for auth resolution and session refreshes, from `sb.events`.
+ * Spans for auth resolution and session refreshes, from `betterSupabase.events`.
  * Returns a function that stops listening.
  */
-export declare function traceAuth(sb: {
+export declare function traceAuth(betterSupabase: {
   readonly events: EventHub;
 }, options?: Pick<OtelOptions, "tracer" | "attributes">): () => void;
 /**

package/dist/otel/index.js

@@ -1,6 +1,6 @@
 import { n as definePlugin } from "../plugin-BqR6wKMB.js";
 import { t as SPEC_PINS } from "../spec-pins-C3oc-Tdp.js";
-import "../version-BfpG2gks.js";
+import "../version-Bmf7_FzM.js";
 import { SpanKind, SpanStatusCode, context, metrics, propagation, trace } from "@opentelemetry/api";
 //#region src/otel/index.ts
 const INSTRUMENTATION_NAME = "better-supabase";
@@ -26,13 +26,13 @@ function systemOf(executor) {
 * never recorded; `db.query.summary` is `SELECT customers`.
 *
 * ```ts
-* const sb = defineSupabase(schema).use(otel());
+* const betterSupabase = defineSupabase(schema).use(otel());
 * ```
 */
 function otel(options = {}) {
-	const tracer = options.tracer ?? trace.getTracer("better-supabase", "0.0.0");
+	const tracer = options.tracer ?? trace.getTracer("better-supabase", "0.4.0");
 	let histogram;
-	if (options.metrics !== false) histogram = (options.meter ?? metrics.getMeter("better-supabase", "0.0.0")).createHistogram("db.client.operation.duration", {
+	if (options.metrics !== false) histogram = (options.meter ?? metrics.getMeter("better-supabase", "0.4.0")).createHistogram("db.client.operation.duration", {
 		unit: "s",
 		description: "Duration of database client operations.",
 		advice: { explicitBucketBoundaries: [
@@ -50,76 +50,95 @@ function otel(options = {}) {
 	return definePlugin({
 		name: "otel",
 		enforce: "post",
-		wrapExecutor: (executor) => ({
-			...executor,
-			name: executor.name,
-			execute(op, executeContext) {
+		wrapExecutor: (executor) => {
+			const system = systemOf(executor);
+			/** Span and metric attributes per table and operation, built once. */
+			const described = /* @__PURE__ */ new Map();
+			const describe = (op) => {
 				const operation = operationName(op);
-				const summary = `${operation} ${op.table.name}`;
-				const attributes = {
-					...options.attributes,
-					"db.system.name": systemOf(executor),
-					"db.namespace": op.table.schema,
-					"db.collection.name": op.table.name,
-					"db.operation.name": operation,
-					"db.query.summary": summary,
-					"better_supabase.executor": executor.name
-				};
-				const started = performance.now();
-				return tracer.startActiveSpan(summary, {
-					kind: SpanKind.CLIENT,
-					attributes
-				}, async (span) => {
-					const finish = (errorType) => {
-						const metricAttributes = {
-							"db.system.name": attributes["db.system.name"],
+				const key = `${op.table.key}:${operation}`;
+				let entry = described.get(key);
+				if (!entry) {
+					const summary = `${operation} ${op.table.name}`;
+					entry = {
+						summary,
+						attributes: {
+							...options.attributes,
+							"db.system.name": system,
+							"db.namespace": op.table.schema,
 							"db.collection.name": op.table.name,
 							"db.operation.name": operation,
-							...errorType ? { "error.type": errorType } : {}
-						};
-						histogram?.record((performance.now() - started) / 1e3, metricAttributes);
-						span.end();
+							"db.query.summary": summary,
+							"better_supabase.executor": executor.name
+						},
+						metric: {
+							"db.system.name": system,
+							"db.collection.name": op.table.name,
+							"db.operation.name": operation
+						}
 					};
-					try {
-						const result = await executor.execute(op, executeContext);
-						if (result.ok) {
-							span.setAttribute("db.response.returned_rows", result.data.rows.length);
-							finish();
-						} else {
-							span.setAttributes({
-								"error.type": result.error.kind,
-								...result.error.code ? { "db.response.status_code": result.error.code } : {}
-							});
+					described.set(key, entry);
+				}
+				return entry;
+			};
+			return {
+				...executor,
+				name: executor.name,
+				execute(op, executeContext) {
+					const { summary, attributes, metric } = describe(op);
+					const started = performance.now();
+					return tracer.startActiveSpan(summary, {
+						kind: SpanKind.CLIENT,
+						attributes
+					}, async (span) => {
+						const finish = (errorType) => {
+							histogram?.record((performance.now() - started) / 1e3, errorType ? {
+								...metric,
+								"error.type": errorType
+							} : metric);
+							span.end();
+						};
+						try {
+							const result = await executor.execute(op, executeContext);
+							if (result.ok) {
+								if (span.isRecording()) span.setAttribute("db.response.returned_rows", result.data.rows.length);
+								finish();
+							} else {
+								span.setAttributes({
+									"error.type": result.error.kind,
+									...result.error.code ? { "db.response.status_code": result.error.code } : {}
+								});
+								span.setStatus({
+									code: SpanStatusCode.ERROR,
+									message: result.error.message
+								});
+								finish(result.error.kind);
+							}
+							return result;
+						} catch (cause) {
+							const error = cause instanceof Error ? cause : new Error(String(cause));
+							span.recordException(error);
+							span.setAttribute("error.type", error.name);
 							span.setStatus({
 								code: SpanStatusCode.ERROR,
-								message: result.error.message
+								message: error.message
 							});
-							finish(result.error.kind);
+							finish(error.name);
+							throw cause;
 						}
-						return result;
-					} catch (cause) {
-						const error = cause instanceof Error ? cause : new Error(String(cause));
-						span.recordException(error);
-						span.setAttribute("error.type", error.name);
-						span.setStatus({
-							code: SpanStatusCode.ERROR,
-							message: error.message
-						});
-						finish(error.name);
-						throw cause;
-					}
-				});
-			}
-		})
+					});
+				}
+			};
+		}
 	});
 }
 /**
-* Spans for auth resolution and session refreshes, from `sb.events`.
+* Spans for auth resolution and session refreshes, from `betterSupabase.events`.
 * Returns a function that stops listening.
 */
-function traceAuth(sb, options = {}) {
-	const tracer = options.tracer ?? trace.getTracer("better-supabase", "0.0.0");
-	const offAuth = sb.events.on("auth", (event) => {
+function traceAuth(betterSupabase, options = {}) {
+	const tracer = options.tracer ?? trace.getTracer("better-supabase", "0.4.0");
+	const offAuth = betterSupabase.events.on("auth", (event) => {
 		const span = tracer.startSpan("auth.resolve", {
 			kind: SpanKind.INTERNAL,
 			attributes: {
@@ -131,7 +150,7 @@ function traceAuth(sb, options = {}) {
 		if (!event.ok) span.setStatus({ code: SpanStatusCode.ERROR });
 		span.end();
 	});
-	const offRefresh = sb.events.on("refresh", (event) => {
+	const offRefresh = betterSupabase.events.on("refresh", (event) => {
 		const end = Date.now();
 		const span = tracer.startSpan("auth.refresh", {
 			kind: SpanKind.CLIENT,

package/dist/{permdock-sql-Bta_G0v-.js → permdock-sql-C4KFzLc9.js}

@@ -1,4 +1,4 @@
-import { n as dbError, t as DbException } from "./errors-Bl3rkOzo.js";
+import { n as dbError, t as DbException } from "./errors-L0xK41y_.js";
 //#region src/core/template.ts
 const PLACEHOLDER = /\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
 function parseSegment(segment) {

package/dist/{plugin-DVRB8qNE.d.ts → plugin-bNhvJwRh.d.ts}

@@ -1,7 +1,7 @@
 /// <reference lib="esnext.temporal" />
 import { A as SchemaMeta, P as TableMeta, n as AnyModels } from "./types-DONv9SHN.js";
-import { g as Operation, h as MutationOp, r as Executor } from "./executor-DynmIWhq.js";
-import { v as ErrorMapper } from "./result-c2OYgCV2.js";
+import { g as Operation, h as MutationOp, r as Executor } from "./executor-B5IoUxLE.js";
+import { v as ErrorMapper } from "./result-CqEsbgYs.js";
 //#region src/core/plugin.d.ts
 /** Who is making the request. */
 interface Actor {

package/dist/plugins/actor/index.d.ts

@@ -1,4 +1,4 @@
-import { f as Plugin, h as RequestContext } from "../../plugin-DVRB8qNE.js";
+import { f as Plugin, h as RequestContext } from "../../plugin-bNhvJwRh.js";
 //#region src/plugins/actor/index.d.ts
 export interface ActorOptions {
   /** Custom actor id resolution. Defaults to `context.actor.id` for users and services. */

package/dist/plugins/actor/index.js

@@ -1,5 +1,5 @@
 import { n as definePlugin } from "../../plugin-BqR6wKMB.js";
-import { i as insertsOnly, l as withDefault, t as dbName } from "../../shared-_6-uPL7E.js";
+import { i as insertsOnly, l as withDefault, t as dbName } from "../../shared-DnoCdMDr.js";
 //#region src/plugins/actor/index.ts
 function defaultActor(context) {
 	const actor = context.actor;

package/dist/plugins/rules/index.d.ts

@@ -1,5 +1,5 @@
-import { g as Operation } from "../../executor-DynmIWhq.js";
-import { f as Plugin, m as RepositoryExtension } from "../../plugin-DVRB8qNE.js";
+import { g as Operation } from "../../executor-B5IoUxLE.js";
+import { f as Plugin, m as RepositoryExtension } from "../../plugin-bNhvJwRh.js";
 //#region src/plugins/rules/index.d.ts
 export type RuleLevel = "off" | "warn" | "error";
 /** A level, or a level with the rule's option: `['error', 500]`. */

package/dist/plugins/rules/index.js

@@ -1,6 +1,7 @@
-import { n as dbError, t as DbException } from "../../errors-Bl3rkOzo.js";
+import { n as dbError, t as DbException } from "../../errors-L0xK41y_.js";
+import { t as lookupOf } from "../../lookup-BaP5bI27.js";
 import { n as definePlugin } from "../../plugin-BqR6wKMB.js";
-import { n as claimAt, r as claimsOf } from "../../claims-CoTobNC-.js";
+import { n as claimAt, r as claimsOf } from "../../claims-BAf6c7is.js";
 //#region src/plugins/rules/index.ts
 /** Catches data-exposure and correctness mistakes; everything else off. */
 function safe() {
@@ -40,17 +41,37 @@ function levelOf(setting) {
 function optionOf(setting, fallback) {
 	return Array.isArray(setting) ? setting[1] : fallback;
 }
+const depths = /* @__PURE__ */ new WeakMap();
 function includeDepth(selection) {
+	let depth = depths.get(selection);
+	if (depth === void 0) {
+		depth = computeIncludeDepth(selection);
+		depths.set(selection, depth);
+	}
+	return depth;
+}
+function computeIncludeDepth(selection) {
 	let depth = 0;
 	for (const include of selection.includes) if (include.count !== void 0 || include.aggregate !== void 0) depth = Math.max(depth, 1);
 	else depth = Math.max(depth, 1 + includeDepth(include.selection));
 	return depth;
 }
+const sensitiveByTable = /* @__PURE__ */ new WeakMap();
+function sensitiveOf(table) {
+	let sensitive = sensitiveByTable.get(table);
+	if (!sensitive) {
+		sensitive = new Set(lookupOf(table).entries.filter(([, column]) => column.sensitive).map(([, column]) => column.db));
+		sensitiveByTable.set(table, sensitive);
+	}
+	return sensitive;
+}
 function sensitiveColumns(selection, table) {
 	const found = [];
-	const sensitive = new Set(Object.values(table.columns).filter((column) => column.sensitive).map((column) => column.db));
-	const columns = [...selection.columns, ...selection.aggregate?.measures ?? []];
-	for (const column of columns) if (sensitive.has(column.column)) found.push(`${table.key}.${column.column}`);
+	const sensitive = sensitiveOf(table);
+	if (sensitive.size > 0) {
+		for (const column of selection.columns) if (sensitive.has(column.column)) found.push(`${table.key}.${column.column}`);
+		for (const measure of selection.aggregate?.measures ?? []) if (sensitive.has(measure.column)) found.push(`${table.key}.${measure.column}`);
+	}
 	for (const include of selection.includes) found.push(...sensitiveColumns(include.selection, include.target));
 	return found;
 }
@@ -73,11 +94,21 @@ function bucketTemplates(schema) {
 	}
 	return templates;
 }
+const urlColumnsByTable = /* @__PURE__ */ new WeakMap();
+/** Scalar text columns named `*_url`, the only ones the rule inspects. */
+function urlColumns(table) {
+	let columns = urlColumnsByTable.get(table);
+	if (!columns) {
+		columns = lookupOf(table).entries.map(([, column]) => column).filter((column) => column.db.endsWith("_url") && !column.array && TEXT_TYPES.has(column.type));
+		urlColumnsByTable.set(table, columns);
+	}
+	return columns;
+}
 function storedObjectColumn(op, schema) {
 	const rows = op.kind === "insert" ? op.rows : op.kind === "update" ? [op.set] : [];
 	if (rows.length === 0) return void 0;
-	for (const column of Object.values(op.table.columns)) {
-		if (!rows.some((row) => column.db in row) || !column.db.endsWith("_url") || column.array || !TEXT_TYPES.has(column.type)) continue;
+	for (const column of urlColumns(op.table)) {
+		if (!rows.some((row) => column.db in row)) continue;
 		const path = `${column.db.slice(0, -4)}_path`;
 		if (column.storage !== void 0) return `"${column.db}" holds paths in bucket "${column.storage}"; name it "${path}"`;
 		if (rows.some((row) => {
@@ -87,15 +118,14 @@ function storedObjectColumn(op, schema) {
 	}
 }
 function checks(rules) {
+	const maxLimit = optionOf(rules.maxLimit, 1e3);
+	const maxDepth = optionOf(rules.maxIncludeDepth, 3);
 	return {
 		noUnboundedFindMany: (op) => op.kind === "select" && op.single === void 0 && !op.head && op.limit === void 0 ? "findMany without limit reads every visible row" : void 0,
-		maxLimit: (op) => {
-			const max = optionOf(rules.maxLimit, 1e3);
-			return op.kind === "select" && op.limit !== void 0 && op.limit > max ? `limit ${op.limit} is above the maximum of ${max}` : void 0;
-		},
+		maxLimit: (op) => op.kind === "select" && op.limit !== void 0 && op.limit > maxLimit ? `limit ${op.limit} is above the maximum of ${maxLimit}` : void 0,
 		requireOrderByForCursor: (op) => op.kind === "select" && !op.head && op.orderBy.length === 0 && (op.offset !== void 0 || op.limit !== void 0 && op.limit > 1) ? "paging without orderBy returns rows in no stable order" : void 0,
 		maxIncludeDepth: (op) => {
-			const max = optionOf(rules.maxIncludeDepth, 3);
+			const max = maxDepth;
 			const selection = op.kind === "select" ? op.selection : op.returning;
 			const depth = selection ? includeDepth(selection) : 0;
 			return depth > max ? `includes nest ${depth} levels deep (maximum ${max})` : void 0;

package/dist/plugins/soft-delete/index.d.ts

@@ -1,6 +1,6 @@
 import { C as PrimaryKeyValue } from "../../types-DONv9SHN.js";
-import { t as AsyncResult } from "../../result-c2OYgCV2.js";
-import { f as Plugin, m as RepositoryExtension, o as HasFlag } from "../../plugin-DVRB8qNE.js";
+import { t as AsyncResult } from "../../result-CqEsbgYs.js";
+import { f as Plugin, m as RepositoryExtension, o as HasFlag } from "../../plugin-bNhvJwRh.js";
 //#region src/plugins/soft-delete/index.d.ts
 export interface SoftDeleteFindArgs {
   /** Include soft-deleted rows of the queried table. */

package/dist/plugins/soft-delete/index.js

@@ -1,8 +1,8 @@
 import { t as and } from "../../types-6cYK9pbJ.js";
-import { i as ok, t as AsyncResult } from "../../result-DWXatkd6.js";
+import { i as ok, t as AsyncResult } from "../../result-Bj6yt33D.js";
 import { n as definePlugin } from "../../plugin-BqR6wKMB.js";
 import { n as scopeOperation } from "../../scope-CDHcS7dE.js";
-import { a as isNotNull, o as isNull, t as dbName } from "../../shared-_6-uPL7E.js";
+import { a as isNotNull, o as isNull, t as dbName } from "../../shared-DnoCdMDr.js";
 //#region src/plugins/soft-delete/index.ts
 function deletedColumn(table) {
 	return dbName(table, table.flags.softDelete);

package/dist/plugins/tenant/index.d.ts

@@ -1,5 +1,5 @@
 import { A as SchemaMeta } from "../../types-DONv9SHN.js";
-import { f as Plugin, h as RequestContext, m as RepositoryExtension, o as HasFlag } from "../../plugin-DVRB8qNE.js";
+import { f as Plugin, h as RequestContext, m as RepositoryExtension, o as HasFlag } from "../../plugin-bNhvJwRh.js";
 //#region src/plugins/tenant/index.d.ts
 /**
  * Dotted paths to the string claims of `C` (up to three levels), e.g.
@@ -7,7 +7,7 @@ import { f as Plugin, h as RequestContext, m as RepositoryExtension, o as HasFla
  */
 export type ClaimPath<C> = unknown extends C ? string : StringPaths<C, [1, 2, 3]>;
 type StringPaths<T, Depth extends readonly unknown[]> = T extends object ? T extends readonly unknown[] ? never : { [K in keyof T & string]-?: (NonNullable<T[K]> extends string ? K : never) | (Depth extends readonly [unknown, ...infer Rest] ? `${K}.${StringPaths<NonNullable<T[K]>, Rest>}` : never); }[keyof T & string] : never;
-/** `C` is the claims type (`sb.claims(schema)`'s output); it types `claim`. */
+/** `C` is the claims type (`betterSupabase.claims(schema)`'s output); it types `claim`. */
 export interface TenantOptions<C = unknown> {
   /**
    * JWT claim path(s) holding the tenant id when `context.tenant` is not set.

package/dist/plugins/tenant/index.js

@@ -1,8 +1,8 @@
-import { n as dbError, t as DbException } from "../../errors-Bl3rkOzo.js";
+import { n as dbError, t as DbException } from "../../errors-L0xK41y_.js";
 import { n as definePlugin } from "../../plugin-BqR6wKMB.js";
 import { n as scopeOperation } from "../../scope-CDHcS7dE.js";
-import { i as tenantClaimPaths, n as claimAt, r as claimsOf } from "../../claims-CoTobNC-.js";
-import { n as equals, r as forbidden, t as dbName } from "../../shared-_6-uPL7E.js";
+import { i as tenantClaimPaths, n as claimAt, r as claimsOf } from "../../claims-BAf6c7is.js";
+import { n as equals, r as forbidden, t as dbName } from "../../shared-DnoCdMDr.js";
 //#region src/plugins/tenant/index.ts
 /**
 * The tenant for a request: `context.tenant`, then the configured claim.
@@ -30,8 +30,14 @@ function tenantColumn(table) {
 */
 function tenant(options = {}) {
 	const onMissing = options.onMissing ?? "error";
+	/** A context is fixed for a connection, so its tenant is resolved once. */
+	const resolved = /* @__PURE__ */ new WeakMap();
 	const current = (table, context, schema) => {
-		const id = resolveTenant(context, options, schema);
+		let id = resolved.get(context);
+		if (id === void 0 && !resolved.has(context)) {
+			id = resolveTenant(context, options, schema);
+			resolved.set(context, id);
+		}
 		if (id === void 0 && onMissing === "error" && tenantColumn(table)) throw new DbException(dbError("forbidden", `No tenant in the request context for "${table.key}"`));
 		return id;
 	};

package/dist/plugins/timestamps/index.d.ts

@@ -1,4 +1,4 @@
-import { f as Plugin } from "../../plugin-DVRB8qNE.js";
+import { f as Plugin } from "../../plugin-bNhvJwRh.js";
 //#region src/plugins/timestamps/index.d.ts
 /**
  * Stamps the columns generated as `Flags.timestamps`: `createdAt` on insert,

package/dist/plugins/timestamps/index.js

@@ -1,5 +1,5 @@
 import { n as definePlugin } from "../../plugin-BqR6wKMB.js";
-import { i as insertsOnly, l as withDefault, t as dbName } from "../../shared-_6-uPL7E.js";
+import { i as insertsOnly, l as withDefault, t as dbName } from "../../shared-DnoCdMDr.js";
 //#region src/plugins/timestamps/index.ts
 /**
 * Stamps the columns generated as `Flags.timestamps`: `createdAt` on insert,

package/dist/plugins/validation/index.d.ts

@@ -1,5 +1,5 @@
-import { f as Plugin } from "../../plugin-DVRB8qNE.js";
-import { t as StandardSchemaV1 } from "../../standard-eudBiRk1.js";
+import { f as Plugin } from "../../plugin-bNhvJwRh.js";
+import { t as StandardSchemaV1 } from "../../standard-BsaCYQJc.js";
 //#region src/plugins/validation/index.d.ts
 export interface TableValidators {
   /** Validates inserts and upserts, with app-cased keys. */

package/dist/plugins/validation/index.js

@@ -1,7 +1,7 @@
-import { n as dbError, t as DbException } from "../../errors-Bl3rkOzo.js";
+import { n as dbError, t as DbException } from "../../errors-L0xK41y_.js";
 import { n as definePlugin } from "../../plugin-BqR6wKMB.js";
-import { t as validate } from "../../standard-FUi3Z3-7.js";
-import { c as toDb, s as toApp } from "../../shared-_6-uPL7E.js";
+import { t as validate } from "../../standard-BRyBGTtp.js";
+import { c as toDb, s as toApp } from "../../shared-DnoCdMDr.js";
 //#region src/plugins/validation/index.ts
 async function check(schema, table, row, label, index) {
 	const result = await validate(schema, toApp(table, row), label);