create-githat-app 1.8.8 → 1.8.10

package/dist/cli.js

@@ -21,7 +21,7 @@ var DEPS = {
       next: "^16.0.0",
       react: "^19.0.0",
       "react-dom": "^19.0.0",
-      "@githat/nextjs": "^0.13.5",
+      "@githat/nextjs": "^0.13.7",
       "@githat/ui": "^1.0.0"
     },
     devDependencies: {
@@ -36,7 +36,7 @@ var DEPS = {
       react: "^19.0.0",
       "react-dom": "^19.0.0",
       "react-router-dom": "^7.0.0",
-      "@githat/nextjs": "^0.13.5",
+      "@githat/nextjs": "^0.13.7",
       "@githat/ui": "^1.0.0"
     },
     devDependencies: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-githat-app",
-  "version": "1.8.8",
+  "version": "1.8.10",
   "description": "GitHat CLI — scaffold apps and manage the skills marketplace",
   "type": "module",
   "bin": {

package/templates/base/README.md.hbs

@@ -175,6 +175,112 @@ your site, never elsewhere, even if a user has the same passkey
 "saved" in their password manager. This is the correct security
 model.
 
+## Realtime subscriptions
+
+`useRealtime()` gives you a live WebSocket connection to GitHat's realtime
+API. Any event GitHat records (sign-in, MFA toggle, file upload, webhook
+delivery) is pushed to subscribed clients instantly — no polling required.
+
+A common use: keep `/account/activity` up-to-date without a page reload.
+
+```tsx
+'use client';
+
+import { useEffect, useState } from 'react';
+import { useAuth, useRealtime, useAuditLog } from '@githat/nextjs';
+import type { AuditEvent } from '@githat/nextjs';
+
+export default function ActivityFeedPage() {
+  const { user } = useAuth();
+  const { subscribe, status } = useRealtime();
+  const { list } = useAuditLog();
+  const [events, setEvents] = useState<AuditEvent[]>([]);
+
+  // Initial load
+  useEffect(() => {
+    list({ limit: 50 }).then(({ events }) => setEvents(events));
+  }, [list]);
+
+  // Live updates via WebSocket
+  useEffect(() => {
+    if (!user?.id) return;
+
+    const unsub = subscribe(`audit.${user.id}`, () => {
+      // Refresh the list whenever a new audit event arrives
+      list({ limit: 50 }).then(({ events }) => setEvents(events));
+    });
+
+    return unsub; // unsubscribes on unmount
+  }, [user?.id, subscribe, list]);
+
+  return (
+    <div>
+      <p>Connection: {status}</p>
+      <ul>
+        {events.map((e) => (
+          <li key={e.sk}>{e.action} — {e.created_at}</li>
+        ))}
+      </ul>
+    </div>
+  );
+}
+```
+
+**Topic conventions:**
+
+| Topic | Events pushed |
+|---|---|
+| `audit.{userId}` | Sign-in, MFA changes, passkey changes |
+| `webhook.{webhookId}` | Webhook delivery results |
+| `storage.{appId}` | File uploads finalized in your app |
+| `users.{userId}` | MFA enabled, passkey added |
+
+Resource-level wildcards are supported: `audit.*` receives every audit event
+for every user in your app. The connection auto-reconnects with exponential
+back-off (1 s → 2 s → 4 s → 8 s → 30 s cap).
+
+## Row-Level Security
+
+GitHat RLS lets you define per-collection policies that gate which rows each user
+can read or write — without writing any backend code. Policies are evaluated on
+every `useData()` call and stored in the GitHat dashboard.
+
+### Quick example
+
+```tsx
+import { useRLS } from '@githat/nextjs';
+
+const { setPolicy, testPolicy } = useRLS();
+
+// Ensure users can only read/write their own rows in "documents"
+await setPolicy('documents', {
+  readPolicy:  { type: 'fieldEquals', field: 'userId', context: 'callerUserId' },
+  writePolicy: { type: 'fieldEquals', field: 'userId', context: 'callerUserId' },
+});
+
+// Dry-run before shipping
+const { allowed, reasons } = await testPolicy({
+  collection: 'documents',
+  row: { userId: 'user-abc', title: 'My doc' },
+  operation: 'read',
+  context: { userId: 'user-abc' },
+});
+// → { allowed: true, reasons: ['policy satisfied'] }
+```
+
+### Predicate types
+
+| Type | Description |
+|------|-------------|
+| `public` | Matches everything — no restriction |
+| `fieldEquals` | `row[field]` must equal `callerUserId` or `callerOrgId` |
+| `fieldIn` | `row[field]` must be in caller's org list |
+| `orgRoleAtLeast` | Caller must hold `owner`, `admin`, or `member` in the row's org |
+| `and` / `or` / `not` | Compose any of the above |
+
+Manage policies visually at **Dashboard → Row-Level Security** or via `useRLS()`.
+If no policy is set, all authenticated users have access (backwards-compatible default).
+
 ## Learn More
 
 - [GitHat Documentation](https://githat.io/docs)