create-githat-app 1.8.9 → 1.8.10

package/dist/cli.js

@@ -21,7 +21,7 @@ var DEPS = {
       next: "^16.0.0",
       react: "^19.0.0",
       "react-dom": "^19.0.0",
-      "@githat/nextjs": "^0.13.6",
+      "@githat/nextjs": "^0.13.7",
       "@githat/ui": "^1.0.0"
     },
     devDependencies: {
@@ -36,7 +36,7 @@ var DEPS = {
       react: "^19.0.0",
       "react-dom": "^19.0.0",
       "react-router-dom": "^7.0.0",
-      "@githat/nextjs": "^0.13.6",
+      "@githat/nextjs": "^0.13.7",
       "@githat/ui": "^1.0.0"
     },
     devDependencies: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-githat-app",
-  "version": "1.8.9",
+  "version": "1.8.10",
   "description": "GitHat CLI — scaffold apps and manage the skills marketplace",
   "type": "module",
   "bin": {

package/templates/base/README.md.hbs

@@ -239,6 +239,48 @@ Resource-level wildcards are supported: `audit.*` receives every audit event
 for every user in your app. The connection auto-reconnects with exponential
 back-off (1 s → 2 s → 4 s → 8 s → 30 s cap).
 
+## Row-Level Security
+
+GitHat RLS lets you define per-collection policies that gate which rows each user
+can read or write — without writing any backend code. Policies are evaluated on
+every `useData()` call and stored in the GitHat dashboard.
+
+### Quick example
+
+```tsx
+import { useRLS } from '@githat/nextjs';
+
+const { setPolicy, testPolicy } = useRLS();
+
+// Ensure users can only read/write their own rows in "documents"
+await setPolicy('documents', {
+  readPolicy:  { type: 'fieldEquals', field: 'userId', context: 'callerUserId' },
+  writePolicy: { type: 'fieldEquals', field: 'userId', context: 'callerUserId' },
+});
+
+// Dry-run before shipping
+const { allowed, reasons } = await testPolicy({
+  collection: 'documents',
+  row: { userId: 'user-abc', title: 'My doc' },
+  operation: 'read',
+  context: { userId: 'user-abc' },
+});
+// → { allowed: true, reasons: ['policy satisfied'] }
+```
+
+### Predicate types
+
+| Type | Description |
+|------|-------------|
+| `public` | Matches everything — no restriction |
+| `fieldEquals` | `row[field]` must equal `callerUserId` or `callerOrgId` |
+| `fieldIn` | `row[field]` must be in caller's org list |
+| `orgRoleAtLeast` | Caller must hold `owner`, `admin`, or `member` in the row's org |
+| `and` / `or` / `not` | Compose any of the above |
+
+Manage policies visually at **Dashboard → Row-Level Security** or via `useRLS()`.
+If no policy is set, all authenticated users have access (backwards-compatible default).
+
 ## Learn More
 
 - [GitHat Documentation](https://githat.io/docs)