[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-prisma-prisma-next-supabase":3,"mdc-pe3yvh-key":38,"related-repo-prisma-prisma-next-supabase":5544,"related-org-prisma-prisma-next-supabase":5643},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":26,"repoUrl":27,"updatedAt":28,"license":29,"forks":30,"topics":31,"repo":34,"sourceUrl":36,"mdContent":37},"prisma-next-supabase","integrate Prisma with Supabase","Use Prisma Next with a Supabase project via `@prisma-next\u002Fextension-supabase` — wire `extensions: [supabasePack]`, declare cross-space FKs to `supabase:auth.AuthUser`, author RLS policies (`policy_select` \u002F `policy_update` \u002F `@@rls`, `auth.uid()` predicates), build `db.ts` with the `supabase()` factory, bind roles per request (`asUser(jwt)` \u002F `asAnon()` \u002F `asServiceRole()`), query `auth.*` \u002F `storage.*` via the `db.asServiceRole().supabase` admin root, and validate JWTs (`jwksUrl` for current projects \u002F `jwtSecret` for legacy HS256). Use for supabase, RLS, row level security, policy, role binding, anon, authenticated, service_role, auth.users, auth.uid(), JWT, JWKS, SUPABASE_JWKS_URL, SUPABASE_JWT_SECRET, SUPABASE.JWT_INVALID, SUPABASE.CONFIG_INVALID, RoleBoundDb, session pooler, supabase:auth.AuthUser, @prisma-next\u002Fextension-supabase.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"prisma","Prisma","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fprisma.png",[12,16,19,22,23],{"name":13,"slug":14,"type":15},"Auth","auth","tag",{"name":17,"slug":18,"type":15},"Supabase","supabase",{"name":20,"slug":21,"type":15},"ORM","orm",{"name":9,"slug":8,"type":15},{"name":24,"slug":25,"type":15},"PostgreSQL","postgresql",415,"https:\u002F\u002Fgithub.com\u002Fprisma\u002Fprisma-next","2026-07-30T05:30:11.065251",null,15,[32,33],"loggy-core","loggy-terminal",{"repoUrl":27,"stars":26,"forks":30,"topics":35,"description":29},[32,33],"https:\u002F\u002Fgithub.com\u002Fprisma\u002Fprisma-next\u002Ftree\u002FHEAD\u002Fskills\u002Fprisma-next-supabase","---\nname: prisma-next-supabase\ndescription: \"Use Prisma Next with a Supabase project via `@prisma-next\u002Fextension-supabase` — wire `extensions: [supabasePack]`, declare cross-space FKs to `supabase:auth.AuthUser`, author RLS policies (`policy_select` \u002F `policy_update` \u002F `@@rls`, `auth.uid()` predicates), build `db.ts` with the `supabase()` factory, bind roles per request (`asUser(jwt)` \u002F `asAnon()` \u002F `asServiceRole()`), query `auth.*` \u002F `storage.*` via the `db.asServiceRole().supabase` admin root, and validate JWTs (`jwksUrl` for current projects \u002F `jwtSecret` for legacy HS256). Use for supabase, RLS, row level security, policy, role binding, anon, authenticated, service_role, auth.users, auth.uid(), JWT, JWKS, SUPABASE_JWKS_URL, SUPABASE_JWT_SECRET, SUPABASE.JWT_INVALID, SUPABASE.CONFIG_INVALID, RoleBoundDb, session pooler, supabase:auth.AuthUser, @prisma-next\u002Fextension-supabase.\"\n---\n\n# Prisma Next — Supabase\n\n> **Edit your data contract. Prisma handles the rest.**\n\nThis skill covers using Prisma Next against a **Supabase** project end-to-end: composing the Supabase extension pack, referencing Supabase-owned tables from your contract, authoring row-level-security (RLS) policies, and running role-bound queries through the `supabase()` runtime.\n\n## When to Use\n\n- User has a Supabase project (or wants one) and is wiring Prisma Next into it.\n- User wants RLS policies on their tables (`policy_select`, `@@rls`, `auth.uid()`).\n- User wants per-request role binding (`asUser(jwt)`, `asAnon()`, `asServiceRole()`).\n- User wants a foreign key into `auth.users` (cross-space FK).\n- User wants to read Supabase-internal tables (`auth.*`, `storage.*`) as an admin.\n- User mentions: *supabase, RLS, row level security, policy, anon, authenticated, service_role, auth.users, auth.uid(), JWT, jwtSecret, jwksUrl, SUPABASE.JWT_INVALID, RoleBoundDb, session pooler*.\n\n## When Not to Use\n\n- General contract editing (models, fields, relations) → `prisma-next-contract`.\n- Non-Supabase `db.ts` wiring, middleware, teardown → `prisma-next-runtime`.\n- General query shapes (filtering, includes, aggregates) → `prisma-next-queries` — everything there applies to a role-bound `db` too.\n- Migration planning \u002F applying → `prisma-next-migrations`.\n\n## Key Concepts\n\n- **The pack is an `external` contract space.** `@prisma-next\u002Fextension-supabase\u002Fpack` ships a complete, introspection-generated contract of everything Supabase owns — the `auth` and `storage` schemas, their native enum types, and the platform roles (`anon`, `authenticated`, `service_role`) — all with control policy `external`. Composed via `extensions`, it means: the migration planner **emits no DDL** for those objects (Supabase manages them), and `db verify` **confirms they exist** in the live database. Your own tables stay `managed` as usual.\n- **Roles come from the pack; you never declare them.** RLS `roles = [authenticated]` identifiers resolve against the composed contract. Pointing the runtime at a non-Supabase Postgres fails verify with a `not-found` issue naming the missing role — the common \"wrong database\" misconfiguration surfaces before queries run.\n- **The runtime is role-first.** `supabase()` returns a `SupabaseDb` with **no top-level query surface** — there is no `db.sql` \u002F `db.orm` until you bind a role. `await db.asUser(jwt)` \u002F `db.asAnon()` \u002F `db.asServiceRole()` each return a `RoleBoundDb` exposing `.sql`, `.orm`, `.raw`, `.execute(plan)`, and `.transaction(fn)`. This is deliberate: in a Supabase app there is no meaningful \"no role\" execution context, and defaulting to the connection's login role is a silent-RLS-bypass footgun.\n- **Role binding is below middleware and cannot leak.** Each role-bound query runs on a connection that had `set_config('role', …)` and `set_config('request.jwt.claims', …)` applied beneath the user-middleware chain, with `RESET ALL` on release. Postgres-side `auth.uid()` \u002F `auth.jwt()` read those session vars — RLS enforcement is Postgres's job; the runtime's job is binding the context.\n- **RLS is enforced by policies *and* grants.** Policies filter *rows*; `GRANT` controls *table access*. Prisma Next authors and migrates the policies; it does not author grants (see *What Prisma Next doesn't do yet*). A role with policies but no `GRANT` gets a permission error, not filtered rows. On Supabase your `public` tables already carry the platform-role grants via default privileges — the grant that is actually missing out of the box is `service_role`'s on `auth.*` \u002F `storage.*` (see *Workflow — Grants*).\n- **JWT validation is eager and configurable — current Supabase projects need `jwksUrl`.** `asUser(jwt)` verifies the token (via `jose`) *before* any connection is acquired: signature + expiry against `jwksUrl` (asymmetric signing keys — **the default on current Supabase projects**, which sign ES256) **xor** `jwtSecret` (the symmetric HS256 secret — legacy projects only). Both or neither → a structured error with code `SUPABASE.CONFIG_INVALID`. Bad tokens throw a structured error with code `SUPABASE.JWT_INVALID` and a typed `meta.reason` — including a mismatch between the token's algorithm and the configured key source (an ES256 token against a `jwtSecret` client names the problem and tells you to switch to `jwksUrl`). The Postgres role is derived from the token's `role` claim (defaults to `authenticated`). Note: `supabase status` still prints a `JWT_SECRET` even on projects that sign ES256 — its presence does not mean your project uses it.\n- **Admin access to `auth.*` \u002F `storage.*` is a secondary root on `service_role` only — and needs a one-time grant.** `db.asServiceRole().supabase` exposes the pack's own contract (`.sql`, `.orm`, `.nativeEnums`, `.execute`). The root exists only on `service_role` by design, but a real Supabase project grants `service_role` **no table privileges** on `auth.*` \u002F `storage.*` (only schema `USAGE`; only `postgres` holds table grants). Before the admin root can read a Supabase-internal table, run the narrow grant once (see *Workflow — Grants*). `asUser` \u002F `asAnon` have no `.supabase`, and the primary `asServiceRole().sql` \u002F `.orm` stay scoped to *your* contract.\n\n## Workflow — Wire the pack into the config\n\nThe concept: the pack registers the Supabase contract space so your contract can reference it and the planner\u002Fverifier know what Supabase owns. The extension has no `\u002Fcontrol` subpath yet, so it can't go through the target façade's `defineConfig({ extensions: [...] })` — it wires into the low-level config's `extensions` (see *What Prisma Next doesn't do yet*). The low-level imports below are a **deliberate exception** to the façade-only import rule, forced by that gap; the block mirrors `examples\u002Fsupabase\u002Fprisma-next.config.ts` verbatim — copy it rather than composing your own:\n\n```typescript\n\u002F\u002F prisma-next.config.ts\nimport postgresAdapter from '@prisma-next\u002Fadapter-postgres\u002Fcontrol';\nimport { defineConfig } from '@prisma-next\u002Fcli\u002Fconfig-types';\nimport postgresDriver from '@prisma-next\u002Fdriver-postgres\u002Fcontrol';\nimport supabasePack from '@prisma-next\u002Fextension-supabase\u002Fpack';\nimport sql from '@prisma-next\u002Ffamily-sql\u002Fcontrol';\nimport { prismaContract } from '@prisma-next\u002Fsql-contract-psl\u002Fprovider';\nimport postgres from '@prisma-next\u002Ftarget-postgres\u002Fcontrol';\nimport postgresPackRef from '@prisma-next\u002Ftarget-postgres\u002Fpack';\nimport { postgresCreateNamespace } from '@prisma-next\u002Ftarget-postgres\u002Ftypes';\n\nexport default defineConfig({\n  family: sql,\n  target: postgres,\n  adapter: postgresAdapter,\n  driver: postgresDriver,\n  extensions: [supabasePack],\n  contract: prismaContract('.\u002Fsrc\u002Fcontract.prisma', {\n    output: 'src\u002Fcontract.json',\n    target: postgresPackRef,\n    createNamespace: postgresCreateNamespace,\n  }),\n  migrations: { dir: 'migrations' },\n});\n```\n\n## Workflow — Contract: FK into `auth.users` + RLS policies\n\nThe concept: your models live in your namespaces (`public`); Supabase's live in the pack's (`auth`, `storage`). A relation field typed `supabase:auth.AuthUser` is a **cross-space FK** — the planner emits `REFERENCES \"auth\".\"users\"(\"id\")`, and the target table is verified, never migrated. RLS policies are top-level `policy_\u003Coperation>` blocks in the same namespace as their target model, and the target model must opt in with `@@rls`. Mirror `examples\u002Fsupabase\u002Fsrc\u002Fcontract.prisma`:\n\n```prisma\nnamespace public {\n  model Profile {\n    id       Uuid   @id @default(uuid())\n    username String\n    userId   Uuid   @unique\n    user     supabase:auth.AuthUser @relation(fields: [userId], references: [id], onDelete: Cascade)\n    @@map(\"profile\")\n    @@rls\n  }\n\n  \u002F\u002F authenticated may read only their own profile.\n  policy_select profile_owner_read {\n    target = Profile\n    roles  = [authenticated]\n    using  = \"\\\"userId\\\"::uuid = auth.uid()\"\n  }\n\n  \u002F\u002F anon may read every profile (a public directory listing).\n  policy_select profile_public_read {\n    target = Profile\n    roles  = [anon]\n    using  = \"true\"\n  }\n\n  \u002F\u002F authenticated may update only their own profile, and may not\n  \u002F\u002F reassign it to another owner (WITH CHECK).\n  policy_update profile_owner_write {\n    target    = Profile\n    roles     = [authenticated]\n    using     = \"\\\"userId\\\"::uuid = auth.uid()\"\n    withCheck = \"\\\"userId\\\"::uuid = auth.uid()\"\n  }\n}\n```\n\nThe `Uuid` constructor selects native UUID storage in type position. The legacy `@db.Uuid` spelling is removed; rewrite any `String @db.Uuid` alias or field as `Uuid` before emitting.\n\nThe pieces:\n\n- **Per-operation policy blocks**: `policy_select`, `policy_insert`, `policy_update`, `policy_delete`, `policy_all`. Body is `key = value`: `target` (a model in this namespace), `roles` (resolve against the composed contract — the pack supplies `anon` \u002F `authenticated` \u002F `service_role`), `using`, and (for write operations) `withCheck`. Multiple permissive policies per `(target, operation)` are valid — Postgres ORs them.\n- **`@@rls` is required on policy targets.** A `policy_*` block whose target model lacks `@@rls` fails emit with `PSL_EXTENSION_TARGET_MODEL_MISSING_ATTRIBUTE`. A model with `@@rls` and *no* policies is also meaningful: RLS enabled, deny-all.\n- **Predicates are verbatim SQL strings.** Quote camelCase column names inside them (`\\\"userId\\\"`), and cast where needed — `auth.uid()` returns `uuid`. Renames in your contract do not rewrite predicate bodies.\n- **TS-builder parity exists.** `@prisma-next\u002Fpostgres\u002Fcontract-builder` exports `policySelect` \u002F `policyInsert` \u002F `policyUpdate` \u002F `policyDelete` \u002F `policyAll`, `rlsEnabled(Model)`, and `role('anon')` — mirroring the PSL lowering key-for-key (identical emitted wire names). PSL is the canonical path shown here.\n\nEmit + migrate as usual (`prisma-next contract emit`, then `prisma-next-migrations`). The plan creates your table, its FK, `ENABLE ROW LEVEL SECURITY`, and the `CREATE POLICY` statements — and **no DDL for `auth.*`**.\n\n## Workflow — `db.ts` with the `supabase()` factory\n\nThe concept: instead of the stock `postgres()` factory, a Supabase app builds its client with `supabase()` from the extension's `\u002Fruntime` subpath. The factory is **async** (it prepares JWT key material — including the one-time JWKS fetch when `jwksUrl` is set), and the result is role-first.\n\n```typescript\n\u002F\u002F src\u002Fprisma\u002Fdb.ts\nimport { supabase } from '@prisma-next\u002Fextension-supabase\u002Fruntime';\nimport type { Contract } from '.\u002Fcontract.d';\nimport contractJson from '.\u002Fcontract.json' with { type: 'json' };\n\nexport const db = await supabase\u003CContract>({\n  contractJson,\n  url: process.env['DATABASE_URL'],        \u002F\u002F direct Postgres connection — see pitfalls\n  jwksUrl: process.env['SUPABASE_JWKS_URL'], \u002F\u002F https:\u002F\u002F\u003Cproject-ref>.supabase.co\u002Fauth\u002Fv1\u002F.well-known\u002Fjwks.json\n  \u002F\u002F Legacy HS256 projects use jwtSecret: process.env['SUPABASE_JWT_SECRET'] instead — exactly one of the two.\n});\n```\n\nOptions beyond the basics: `middleware` (same composition as `postgres()` — see `prisma-next-runtime`; middleware never sees the role-binding `set_config` calls), `poolOptions`, `pg` (BYO `pg.Pool` \u002F `pg.Client` instead of `url`). Teardown is `await db.close()` \u002F `await using` exactly as in `prisma-next-runtime` — the same script-hang rules apply.\n\n## Workflow — Role-bound queries\n\nThe concept: bind the role that should execute the request, then query through the returned `RoleBoundDb` — every query surface from `prisma-next-queries` works, RLS-filtered by Postgres.\n\n```typescript\n\u002F\u002F A signed-in user: rows are RLS-scoped to the JWT's auth.uid().\nconst userDb = await db.asUser(jwt); \u002F\u002F async — rejects with code SUPABASE.JWT_INVALID on a bad\u002Fexpired token\nconst mine = await userDb.orm.public.Profile.select('id', 'username').all();\n\n\u002F\u002F The anon role: sees what anon policies permit.\nconst listing = await db.asAnon().orm.public.Profile.select('id', 'username').all();\n\n\u002F\u002F service_role: BYPASSRLS — sees everything in YOUR contract.\nconst all = await db.asServiceRole().orm.public.Profile.select('id', 'username').all();\n\n\u002F\u002F Writes ride the same surfaces; RLS filters them too. An UPDATE against\n\u002F\u002F another owner's row affects 0 rows; a withCheck violation raises an error.\nconst updated = await userDb.orm.public.Profile\n  .where({ userId: me })\n  .updateAndCount({ username: 'new-name' });\n```\n\nNotes: `asAnon()` \u002F `asServiceRole()` are sync; only `asUser` is async. Multi-namespace contracts address models by coordinate (`orm.public.Profile`, `sql.public.profile`) — see `prisma-next-queries` § *Namespace-aware accessors*. `RoleBoundDb.transaction(fn)` wraps work in a transaction on the role-bound session.\n\n## Workflow — Admin reads of `auth.*` \u002F `storage.*`\n\nThe concept: Supabase-internal tables are not part of your contract, so they are not on your query surfaces. The `service_role` binding carries a **secondary root** — `db.asServiceRole().supabase` — which is the *pack's* contract surface:\n\n```typescript\nconst admin = db.asServiceRole();\n\n\u002F\u002F SQL builder over the pack contract:\nconst users = await admin.supabase\n  .execute(admin.supabase.sql.auth.users.select('id', 'email').build())\n  .toArray();\n\n\u002F\u002F ORM over the pack contract:\nconst sessions = await admin.supabase.orm.auth.AuthSession.select('id', 'aal').all();\n\n\u002F\u002F Native enum values (e.g. auth.aal_level) come typed:\ntype AalLevel = (typeof admin.supabase.nativeEnums.auth.AalLevel)['Value'];\n```\n\n**The admin root needs a one-time grant.** A real Supabase project gives `service_role` no table privileges on `auth.*` \u002F `storage.*` — out of the box, the reads above fail with `permission denied for table users` (sqlState `42501`). Grant exactly what you read, narrowly:\n\n```sql\nGRANT USAGE ON SCHEMA auth TO service_role;\nGRANT SELECT ON TABLE auth.users TO service_role;\n```\n\nOther boundaries to respect: `asUser` \u002F `asAnon` have **no** `.supabase`; the admin root has **no** `.transaction` (it is a separate contract-bound runtime sharing the pool — a transaction spanning both roots is out of scope); and for user *management* (creating users, password resets) prefer the GoTrue Admin API — Supabase-internal schemas can drift across platform upgrades; direct `service_role` SQL is for ad-hoc admin reads.\n\n## Workflow — Grants\n\nThe concept: RLS policies are row filters on top of ordinary table privileges — a role with policies but no `GRANT` gets `permission denied`, not filtered rows. On Supabase the two directions are easy to get backwards:\n\n- **Your own `public` tables need nothing.** Supabase ships `ALTER DEFAULT PRIVILEGES` on `public`, so tables created by `prisma-next db init` \u002F `migrate` inherit full grants for `anon` \u002F `authenticated` \u002F `service_role` automatically — the same as dashboard-created tables. RLS policies are what actually protect the rows; do not add per-table grants, and do not narrow the defaults unless you have a reason.\n- **The one grant you do need is for admin reads of Supabase-internal tables** — `service_role` has no table privileges on `auth.*` \u002F `storage.*` (see *Admin reads* above for the narrow `GRANT USAGE` \u002F `GRANT SELECT` pair).\n\nRun grants via the Supabase SQL editor or `psql`. Symptom of a missing grant: `permission denied for table …` (sqlState `42501`) instead of an empty result.\n\n## Workflow — Connecting to a real Supabase project\n\nThe concept: the runtime needs a **direct, session-capable** Postgres connection — it binds roles with session-scoped `set_config` + `RESET ALL`.\n\n- **Session pooler** (`aws-0-\u003Cregion>.pooler.supabase.com:5432`, username `postgres.\u003Cproject-ref>`) — works everywhere, IPv4. The default choice.\n- **Direct connection** (`db.\u003Cproject-ref>.supabase.co:5432`) — works, but is **IPv6-only** on new projects; from IPv4-only environments it fails DNS\u002Fconnect.\n- **Transaction pooler (port 6543) — do not use.** Transaction pooling breaks session GUCs; role binding will misbehave.\n\n`.env` carries `DATABASE_URL` and the JWT key source. For current projects that is `SUPABASE_JWKS_URL` — `https:\u002F\u002F\u003Cproject-ref>.supabase.co\u002Fauth\u002Fv1\u002F.well-known\u002Fjwks.json` (local stack: `http:\u002F\u002F127.0.0.1:54321\u002Fauth\u002Fv1\u002F.well-known\u002Fjwks.json`). Only legacy HS256 projects use `SUPABASE_JWT_SECRET` (Project Settings → API → JWT Secret) — and note `supabase status` prints a `JWT_SECRET` even on ES256 projects, so don't infer the mode from its presence; check the JWKS endpoint or a token's header `alg`.\n\n## Common Pitfalls\n\n1. **Using the transaction pooler (port 6543).** Session GUC role binding requires a session-capable connection — use the session pooler (5432) or the direct connection.\n2. **Wiring `jwtSecret` because `supabase status` prints a `JWT_SECRET`.** Current projects sign ES256; `asUser` then throws `SUPABASE.JWT_INVALID` explaining the token is ES256 and the client needs `jwksUrl`. Configure `SUPABASE_JWKS_URL`; reserve `jwtSecret` for legacy HS256 projects.\n3. **Grants in the wrong direction.** Your `public` tables need no grants (Supabase's default privileges cover them; RLS protects the rows) — the grant you need is the narrow `auth.*` pair for `service_role` admin reads. `permission denied` (42501) means a missing grant, not a filtered result.\n4. **Expecting `db.sql` \u002F `db.orm` on the top-level `db`.** The Supabase db is role-first; bind a role, query the `RoleBoundDb`.\n5. **Forgetting `await`** — on the `supabase()` factory and on `asUser(jwt)`. Both are async; `asAnon()` \u002F `asServiceRole()` are not.\n6. **Expecting `.supabase` on `asUser` \u002F `asAnon`.** Admin access to `auth.*` is `service_role`-only by construction — and even `service_role` needs the one-time narrow grant first.\n7. **A `policy_*` block whose target lacks `@@rls`.** Emit fails with `PSL_EXTENSION_TARGET_MODEL_MISSING_ATTRIBUTE` — add `@@rls` to the model.\n8. **Unquoted camelCase columns or missing casts in predicates.** Predicates are verbatim SQL: `\"userId\"` needs quotes; compare uuid to `auth.uid()` with a `::uuid` cast where the column isn't already `uuid`.\n9. **Passing both `jwksUrl` and `jwtSecret`** (or neither) — the `supabase()` promise rejects with `SUPABASE.CONFIG_INVALID`. It's an async factory, so the misconfiguration surfaces as a rejection (`await` \u002F `.catch`), not a synchronous throw.\n10. **Treating an RLS-filtered write as an error.** An `UPDATE` against a row the role can't see affects **0 rows** (no exception); only `withCheck` violations raise.\n\n## What Prisma Next doesn't do yet\n\n- **No `\u002Fcontrol` subpath on the extension** — it can't register through the target façade's `defineConfig({ extensions: [...] })`; wiring goes through the low-level config's `extensions` as shown above. File interest via `prisma-next-feedback`.\n- **`GRANT` authoring.** Table privileges are not contract elements; the one grant a Supabase app needs (the `service_role` `auth.*` pair for admin reads) is run once by hand (SQL editor \u002F `psql`). If you want grants managed by the contract, file via `prisma-next-feedback`.\n- **Transactions spanning the app root and the `.supabase` admin root.** The two roots are separate contract-bound runtimes sharing one pool; a cross-root transaction is not supported.\n- **Triggers \u002F functions as contract elements.** The classic \"create a profile row on signup\" `auth.users` trigger is authored as raw SQL against your database, not in the contract. `auth.uid()` etc. appear only inside opaque policy predicate strings.\n- **Supabase Realtime, storage uploads, PostgREST \u002F `@supabase\u002Fsupabase-js` interop, edge runtimes.** Out of scope for the extension — it speaks Postgres directly (Node.js \u002F Bun).\n\n## Reference Files\n\n- `examples\u002Fsupabase` — the canonical runnable app: config, contract, `db.ts`, acceptance tests, README.\n- `packages\u002F3-extensions\u002Fsupabase\u002FREADME.md` — package-level reference (JWT modes, role-binding model, unsupported scope).\n- `packages\u002F3-extensions\u002Fsupabase\u002Fsrc\u002Fruntime\u002Fsupabase.ts` — the authoritative options\u002Ftype surface (`SupabaseOptions`, `RoleBoundDb`, `ServiceRoleDb`).\n\n## Checklist\n\n- [ ] `extensions: [supabasePack]` in the low-level `defineConfig` (no `\u002Fcontrol` subpath exists).\n- [ ] Cross-space FK typed `supabase:auth.AuthUser` with explicit `fields` \u002F `references` (+ `onDelete` if wanted).\n- [ ] Every policy target model carries `@@rls`; predicates quote camelCase columns and cast for `auth.uid()`.\n- [ ] `db.ts` uses `await supabase\u003CContract>({ contractJson, url, jwksUrl | jwtSecret })` — exactly one JWT key source; `jwksUrl` for current projects, `jwtSecret` only for legacy HS256.\n- [ ] Queries go through a `RoleBoundDb` from `asUser` \u002F `asAnon` \u002F `asServiceRole`; `asUser` is awaited.\n- [ ] `auth.*` \u002F `storage.*` reads go through `asServiceRole().supabase` only, after the one-time narrow grant (`GRANT USAGE ON SCHEMA auth` + `GRANT SELECT` on the tables you read).\n- [ ] No per-table grants added for your own `public` tables — Supabase default privileges cover them; RLS does the protecting.\n- [ ] Connection is session-capable: session pooler or direct connection — never the 6543 transaction pooler.\n- [ ] Did NOT confabulate a `\u002Fcontrol` subpath, a top-level `db.sql`, `.supabase` on non-service roles, or grant authoring in the contract.\n",{"data":39,"body":40},{"name":4,"description":6},{"type":41,"children":42},"root",[43,51,65,85,92,202,208,276,282,964,970,1018,1729,1742,1812,2086,2122,2127,2392,2439,2459,2501,2868,2963,2969,2988,3609,3671,3688,3721,4178,4224,4248,4305,4310,4330,4448,4475,4481,4506,4568,4637,4643,5042,5047,5188,5194,5257,5263,5538],{"type":44,"tag":45,"props":46,"children":47},"element","h1",{"id":4},[48],{"type":49,"value":50},"text","Prisma Next — Supabase",{"type":44,"tag":52,"props":53,"children":54},"blockquote",{},[55],{"type":44,"tag":56,"props":57,"children":58},"p",{},[59],{"type":44,"tag":60,"props":61,"children":62},"strong",{},[63],{"type":49,"value":64},"Edit your data contract. Prisma handles the rest.",{"type":44,"tag":56,"props":66,"children":67},{},[68,70,74,76,83],{"type":49,"value":69},"This skill covers using Prisma Next against a ",{"type":44,"tag":60,"props":71,"children":72},{},[73],{"type":49,"value":17},{"type":49,"value":75}," project end-to-end: composing the Supabase extension pack, referencing Supabase-owned tables from your contract, authoring row-level-security (RLS) policies, and running role-bound queries through the ",{"type":44,"tag":77,"props":78,"children":80},"code",{"className":79},[],[81],{"type":49,"value":82},"supabase()",{"type":49,"value":84}," runtime.",{"type":44,"tag":86,"props":87,"children":89},"h2",{"id":88},"when-to-use",[90],{"type":49,"value":91},"When to Use",{"type":44,"tag":93,"props":94,"children":95},"ul",{},[96,102,130,156,169,189],{"type":44,"tag":97,"props":98,"children":99},"li",{},[100],{"type":49,"value":101},"User has a Supabase project (or wants one) and is wiring Prisma Next into it.",{"type":44,"tag":97,"props":103,"children":104},{},[105,107,113,115,121,122,128],{"type":49,"value":106},"User wants RLS policies on their tables (",{"type":44,"tag":77,"props":108,"children":110},{"className":109},[],[111],{"type":49,"value":112},"policy_select",{"type":49,"value":114},", ",{"type":44,"tag":77,"props":116,"children":118},{"className":117},[],[119],{"type":49,"value":120},"@@rls",{"type":49,"value":114},{"type":44,"tag":77,"props":123,"children":125},{"className":124},[],[126],{"type":49,"value":127},"auth.uid()",{"type":49,"value":129},").",{"type":44,"tag":97,"props":131,"children":132},{},[133,135,141,142,148,149,155],{"type":49,"value":134},"User wants per-request role binding (",{"type":44,"tag":77,"props":136,"children":138},{"className":137},[],[139],{"type":49,"value":140},"asUser(jwt)",{"type":49,"value":114},{"type":44,"tag":77,"props":143,"children":145},{"className":144},[],[146],{"type":49,"value":147},"asAnon()",{"type":49,"value":114},{"type":44,"tag":77,"props":150,"children":152},{"className":151},[],[153],{"type":49,"value":154},"asServiceRole()",{"type":49,"value":129},{"type":44,"tag":97,"props":157,"children":158},{},[159,161,167],{"type":49,"value":160},"User wants a foreign key into ",{"type":44,"tag":77,"props":162,"children":164},{"className":163},[],[165],{"type":49,"value":166},"auth.users",{"type":49,"value":168}," (cross-space FK).",{"type":44,"tag":97,"props":170,"children":171},{},[172,174,180,181,187],{"type":49,"value":173},"User wants to read Supabase-internal tables (",{"type":44,"tag":77,"props":175,"children":177},{"className":176},[],[178],{"type":49,"value":179},"auth.*",{"type":49,"value":114},{"type":44,"tag":77,"props":182,"children":184},{"className":183},[],[185],{"type":49,"value":186},"storage.*",{"type":49,"value":188},") as an admin.",{"type":44,"tag":97,"props":190,"children":191},{},[192,194,200],{"type":49,"value":193},"User mentions: ",{"type":44,"tag":195,"props":196,"children":197},"em",{},[198],{"type":49,"value":199},"supabase, RLS, row level security, policy, anon, authenticated, service_role, auth.users, auth.uid(), JWT, jwtSecret, jwksUrl, SUPABASE.JWT_INVALID, RoleBoundDb, session pooler",{"type":49,"value":201},".",{"type":44,"tag":86,"props":203,"children":205},{"id":204},"when-not-to-use",[206],{"type":49,"value":207},"When Not to Use",{"type":44,"tag":93,"props":209,"children":210},{},[211,223,243,264],{"type":44,"tag":97,"props":212,"children":213},{},[214,216,222],{"type":49,"value":215},"General contract editing (models, fields, relations) → ",{"type":44,"tag":77,"props":217,"children":219},{"className":218},[],[220],{"type":49,"value":221},"prisma-next-contract",{"type":49,"value":201},{"type":44,"tag":97,"props":224,"children":225},{},[226,228,234,236,242],{"type":49,"value":227},"Non-Supabase ",{"type":44,"tag":77,"props":229,"children":231},{"className":230},[],[232],{"type":49,"value":233},"db.ts",{"type":49,"value":235}," wiring, middleware, teardown → ",{"type":44,"tag":77,"props":237,"children":239},{"className":238},[],[240],{"type":49,"value":241},"prisma-next-runtime",{"type":49,"value":201},{"type":44,"tag":97,"props":244,"children":245},{},[246,248,254,256,262],{"type":49,"value":247},"General query shapes (filtering, includes, aggregates) → ",{"type":44,"tag":77,"props":249,"children":251},{"className":250},[],[252],{"type":49,"value":253},"prisma-next-queries",{"type":49,"value":255}," — everything there applies to a role-bound ",{"type":44,"tag":77,"props":257,"children":259},{"className":258},[],[260],{"type":49,"value":261},"db",{"type":49,"value":263}," too.",{"type":44,"tag":97,"props":265,"children":266},{},[267,269,275],{"type":49,"value":268},"Migration planning \u002F applying → ",{"type":44,"tag":77,"props":270,"children":272},{"className":271},[],[273],{"type":49,"value":274},"prisma-next-migrations",{"type":49,"value":201},{"type":44,"tag":86,"props":277,"children":279},{"id":278},"key-concepts",[280],{"type":49,"value":281},"Key Concepts",{"type":44,"tag":93,"props":283,"children":284},{},[285,392,418,532,579,666,801],{"type":44,"tag":97,"props":286,"children":287},{},[288,301,303,309,311,316,318,324,326,332,333,339,340,346,348,353,355,361,363,368,370,376,377,382,384,390],{"type":44,"tag":60,"props":289,"children":290},{},[291,293,299],{"type":49,"value":292},"The pack is an ",{"type":44,"tag":77,"props":294,"children":296},{"className":295},[],[297],{"type":49,"value":298},"external",{"type":49,"value":300}," contract space.",{"type":49,"value":302}," ",{"type":44,"tag":77,"props":304,"children":306},{"className":305},[],[307],{"type":49,"value":308},"@prisma-next\u002Fextension-supabase\u002Fpack",{"type":49,"value":310}," ships a complete, introspection-generated contract of everything Supabase owns — the ",{"type":44,"tag":77,"props":312,"children":314},{"className":313},[],[315],{"type":49,"value":14},{"type":49,"value":317}," and ",{"type":44,"tag":77,"props":319,"children":321},{"className":320},[],[322],{"type":49,"value":323},"storage",{"type":49,"value":325}," schemas, their native enum types, and the platform roles (",{"type":44,"tag":77,"props":327,"children":329},{"className":328},[],[330],{"type":49,"value":331},"anon",{"type":49,"value":114},{"type":44,"tag":77,"props":334,"children":336},{"className":335},[],[337],{"type":49,"value":338},"authenticated",{"type":49,"value":114},{"type":44,"tag":77,"props":341,"children":343},{"className":342},[],[344],{"type":49,"value":345},"service_role",{"type":49,"value":347},") — all with control policy ",{"type":44,"tag":77,"props":349,"children":351},{"className":350},[],[352],{"type":49,"value":298},{"type":49,"value":354},". Composed via ",{"type":44,"tag":77,"props":356,"children":358},{"className":357},[],[359],{"type":49,"value":360},"extensions",{"type":49,"value":362},", it means: the migration planner ",{"type":44,"tag":60,"props":364,"children":365},{},[366],{"type":49,"value":367},"emits no DDL",{"type":49,"value":369}," for those objects (Supabase manages them), and ",{"type":44,"tag":77,"props":371,"children":373},{"className":372},[],[374],{"type":49,"value":375},"db verify",{"type":49,"value":302},{"type":44,"tag":60,"props":378,"children":379},{},[380],{"type":49,"value":381},"confirms they exist",{"type":49,"value":383}," in the live database. Your own tables stay ",{"type":44,"tag":77,"props":385,"children":387},{"className":386},[],[388],{"type":49,"value":389},"managed",{"type":49,"value":391}," as usual.",{"type":44,"tag":97,"props":393,"children":394},{},[395,400,402,408,410,416],{"type":44,"tag":60,"props":396,"children":397},{},[398],{"type":49,"value":399},"Roles come from the pack; you never declare them.",{"type":49,"value":401}," RLS ",{"type":44,"tag":77,"props":403,"children":405},{"className":404},[],[406],{"type":49,"value":407},"roles = [authenticated]",{"type":49,"value":409}," identifiers resolve against the composed contract. Pointing the runtime at a non-Supabase Postgres fails verify with a ",{"type":44,"tag":77,"props":411,"children":413},{"className":412},[],[414],{"type":49,"value":415},"not-found",{"type":49,"value":417}," issue naming the missing role — the common \"wrong database\" misconfiguration surfaces before queries run.",{"type":44,"tag":97,"props":419,"children":420},{},[421,426,427,432,434,440,442,447,449,455,457,463,465,471,472,478,479,485,487,493,495,501,502,508,509,515,516,522,524,530],{"type":44,"tag":60,"props":422,"children":423},{},[424],{"type":49,"value":425},"The runtime is role-first.",{"type":49,"value":302},{"type":44,"tag":77,"props":428,"children":430},{"className":429},[],[431],{"type":49,"value":82},{"type":49,"value":433}," returns a ",{"type":44,"tag":77,"props":435,"children":437},{"className":436},[],[438],{"type":49,"value":439},"SupabaseDb",{"type":49,"value":441}," with ",{"type":44,"tag":60,"props":443,"children":444},{},[445],{"type":49,"value":446},"no top-level query surface",{"type":49,"value":448}," — there is no ",{"type":44,"tag":77,"props":450,"children":452},{"className":451},[],[453],{"type":49,"value":454},"db.sql",{"type":49,"value":456}," \u002F ",{"type":44,"tag":77,"props":458,"children":460},{"className":459},[],[461],{"type":49,"value":462},"db.orm",{"type":49,"value":464}," until you bind a role. ",{"type":44,"tag":77,"props":466,"children":468},{"className":467},[],[469],{"type":49,"value":470},"await db.asUser(jwt)",{"type":49,"value":456},{"type":44,"tag":77,"props":473,"children":475},{"className":474},[],[476],{"type":49,"value":477},"db.asAnon()",{"type":49,"value":456},{"type":44,"tag":77,"props":480,"children":482},{"className":481},[],[483],{"type":49,"value":484},"db.asServiceRole()",{"type":49,"value":486}," each return a ",{"type":44,"tag":77,"props":488,"children":490},{"className":489},[],[491],{"type":49,"value":492},"RoleBoundDb",{"type":49,"value":494}," exposing ",{"type":44,"tag":77,"props":496,"children":498},{"className":497},[],[499],{"type":49,"value":500},".sql",{"type":49,"value":114},{"type":44,"tag":77,"props":503,"children":505},{"className":504},[],[506],{"type":49,"value":507},".orm",{"type":49,"value":114},{"type":44,"tag":77,"props":510,"children":512},{"className":511},[],[513],{"type":49,"value":514},".raw",{"type":49,"value":114},{"type":44,"tag":77,"props":517,"children":519},{"className":518},[],[520],{"type":49,"value":521},".execute(plan)",{"type":49,"value":523},", and ",{"type":44,"tag":77,"props":525,"children":527},{"className":526},[],[528],{"type":49,"value":529},".transaction(fn)",{"type":49,"value":531},". This is deliberate: in a Supabase app there is no meaningful \"no role\" execution context, and defaulting to the connection's login role is a silent-RLS-bypass footgun.",{"type":44,"tag":97,"props":533,"children":534},{},[535,540,542,548,549,555,557,563,565,570,571,577],{"type":44,"tag":60,"props":536,"children":537},{},[538],{"type":49,"value":539},"Role binding is below middleware and cannot leak.",{"type":49,"value":541}," Each role-bound query runs on a connection that had ",{"type":44,"tag":77,"props":543,"children":545},{"className":544},[],[546],{"type":49,"value":547},"set_config('role', …)",{"type":49,"value":317},{"type":44,"tag":77,"props":550,"children":552},{"className":551},[],[553],{"type":49,"value":554},"set_config('request.jwt.claims', …)",{"type":49,"value":556}," applied beneath the user-middleware chain, with ",{"type":44,"tag":77,"props":558,"children":560},{"className":559},[],[561],{"type":49,"value":562},"RESET ALL",{"type":49,"value":564}," on release. Postgres-side ",{"type":44,"tag":77,"props":566,"children":568},{"className":567},[],[569],{"type":49,"value":127},{"type":49,"value":456},{"type":44,"tag":77,"props":572,"children":574},{"className":573},[],[575],{"type":49,"value":576},"auth.jwt()",{"type":49,"value":578}," read those session vars — RLS enforcement is Postgres's job; the runtime's job is binding the context.",{"type":44,"tag":97,"props":580,"children":581},{},[582,594,596,601,603,609,611,616,618,623,625,630,632,638,640,645,647,652,653,658,660,665],{"type":44,"tag":60,"props":583,"children":584},{},[585,587,592],{"type":49,"value":586},"RLS is enforced by policies ",{"type":44,"tag":195,"props":588,"children":589},{},[590],{"type":49,"value":591},"and",{"type":49,"value":593}," grants.",{"type":49,"value":595}," Policies filter ",{"type":44,"tag":195,"props":597,"children":598},{},[599],{"type":49,"value":600},"rows",{"type":49,"value":602},"; ",{"type":44,"tag":77,"props":604,"children":606},{"className":605},[],[607],{"type":49,"value":608},"GRANT",{"type":49,"value":610}," controls ",{"type":44,"tag":195,"props":612,"children":613},{},[614],{"type":49,"value":615},"table access",{"type":49,"value":617},". Prisma Next authors and migrates the policies; it does not author grants (see ",{"type":44,"tag":195,"props":619,"children":620},{},[621],{"type":49,"value":622},"What Prisma Next doesn't do yet",{"type":49,"value":624},"). A role with policies but no ",{"type":44,"tag":77,"props":626,"children":628},{"className":627},[],[629],{"type":49,"value":608},{"type":49,"value":631}," gets a permission error, not filtered rows. On Supabase your ",{"type":44,"tag":77,"props":633,"children":635},{"className":634},[],[636],{"type":49,"value":637},"public",{"type":49,"value":639}," tables already carry the platform-role grants via default privileges — the grant that is actually missing out of the box is ",{"type":44,"tag":77,"props":641,"children":643},{"className":642},[],[644],{"type":49,"value":345},{"type":49,"value":646},"'s on ",{"type":44,"tag":77,"props":648,"children":650},{"className":649},[],[651],{"type":49,"value":179},{"type":49,"value":456},{"type":44,"tag":77,"props":654,"children":656},{"className":655},[],[657],{"type":49,"value":186},{"type":49,"value":659}," (see ",{"type":44,"tag":195,"props":661,"children":662},{},[663],{"type":49,"value":664},"Workflow — Grants",{"type":49,"value":129},{"type":44,"tag":97,"props":667,"children":668},{},[669,681,682,687,689,695,697,702,704,709,711,716,718,723,724,730,732,738,740,746,748,754,756,761,763,768,770,776,778,783,785,791,793,799],{"type":44,"tag":60,"props":670,"children":671},{},[672,674,680],{"type":49,"value":673},"JWT validation is eager and configurable — current Supabase projects need ",{"type":44,"tag":77,"props":675,"children":677},{"className":676},[],[678],{"type":49,"value":679},"jwksUrl",{"type":49,"value":201},{"type":49,"value":302},{"type":44,"tag":77,"props":683,"children":685},{"className":684},[],[686],{"type":49,"value":140},{"type":49,"value":688}," verifies the token (via ",{"type":44,"tag":77,"props":690,"children":692},{"className":691},[],[693],{"type":49,"value":694},"jose",{"type":49,"value":696},") ",{"type":44,"tag":195,"props":698,"children":699},{},[700],{"type":49,"value":701},"before",{"type":49,"value":703}," any connection is acquired: signature + expiry against ",{"type":44,"tag":77,"props":705,"children":707},{"className":706},[],[708],{"type":49,"value":679},{"type":49,"value":710}," (asymmetric signing keys — ",{"type":44,"tag":60,"props":712,"children":713},{},[714],{"type":49,"value":715},"the default on current Supabase projects",{"type":49,"value":717},", which sign ES256) ",{"type":44,"tag":60,"props":719,"children":720},{},[721],{"type":49,"value":722},"xor",{"type":49,"value":302},{"type":44,"tag":77,"props":725,"children":727},{"className":726},[],[728],{"type":49,"value":729},"jwtSecret",{"type":49,"value":731}," (the symmetric HS256 secret — legacy projects only). Both or neither → a structured error with code ",{"type":44,"tag":77,"props":733,"children":735},{"className":734},[],[736],{"type":49,"value":737},"SUPABASE.CONFIG_INVALID",{"type":49,"value":739},". Bad tokens throw a structured error with code ",{"type":44,"tag":77,"props":741,"children":743},{"className":742},[],[744],{"type":49,"value":745},"SUPABASE.JWT_INVALID",{"type":49,"value":747}," and a typed ",{"type":44,"tag":77,"props":749,"children":751},{"className":750},[],[752],{"type":49,"value":753},"meta.reason",{"type":49,"value":755}," — including a mismatch between the token's algorithm and the configured key source (an ES256 token against a ",{"type":44,"tag":77,"props":757,"children":759},{"className":758},[],[760],{"type":49,"value":729},{"type":49,"value":762}," client names the problem and tells you to switch to ",{"type":44,"tag":77,"props":764,"children":766},{"className":765},[],[767],{"type":49,"value":679},{"type":49,"value":769},"). The Postgres role is derived from the token's ",{"type":44,"tag":77,"props":771,"children":773},{"className":772},[],[774],{"type":49,"value":775},"role",{"type":49,"value":777}," claim (defaults to ",{"type":44,"tag":77,"props":779,"children":781},{"className":780},[],[782],{"type":49,"value":338},{"type":49,"value":784},"). Note: ",{"type":44,"tag":77,"props":786,"children":788},{"className":787},[],[789],{"type":49,"value":790},"supabase status",{"type":49,"value":792}," still prints a ",{"type":44,"tag":77,"props":794,"children":796},{"className":795},[],[797],{"type":49,"value":798},"JWT_SECRET",{"type":49,"value":800}," even on projects that sign ES256 — its presence does not mean your project uses it.",{"type":44,"tag":97,"props":802,"children":803},{},[804,829,830,836,838,843,844,849,850,856,857,863,865,870,872,877,878,883,885,890,891,896,898,904,906,912,914,918,920,926,927,933,935,941,943,949,950,955,957,962],{"type":44,"tag":60,"props":805,"children":806},{},[807,809,814,815,820,822,827],{"type":49,"value":808},"Admin access to ",{"type":44,"tag":77,"props":810,"children":812},{"className":811},[],[813],{"type":49,"value":179},{"type":49,"value":456},{"type":44,"tag":77,"props":816,"children":818},{"className":817},[],[819],{"type":49,"value":186},{"type":49,"value":821}," is a secondary root on ",{"type":44,"tag":77,"props":823,"children":825},{"className":824},[],[826],{"type":49,"value":345},{"type":49,"value":828}," only — and needs a one-time grant.",{"type":49,"value":302},{"type":44,"tag":77,"props":831,"children":833},{"className":832},[],[834],{"type":49,"value":835},"db.asServiceRole().supabase",{"type":49,"value":837}," exposes the pack's own contract (",{"type":44,"tag":77,"props":839,"children":841},{"className":840},[],[842],{"type":49,"value":500},{"type":49,"value":114},{"type":44,"tag":77,"props":845,"children":847},{"className":846},[],[848],{"type":49,"value":507},{"type":49,"value":114},{"type":44,"tag":77,"props":851,"children":853},{"className":852},[],[854],{"type":49,"value":855},".nativeEnums",{"type":49,"value":114},{"type":44,"tag":77,"props":858,"children":860},{"className":859},[],[861],{"type":49,"value":862},".execute",{"type":49,"value":864},"). The root exists only on ",{"type":44,"tag":77,"props":866,"children":868},{"className":867},[],[869],{"type":49,"value":345},{"type":49,"value":871}," by design, but a real Supabase project grants ",{"type":44,"tag":77,"props":873,"children":875},{"className":874},[],[876],{"type":49,"value":345},{"type":49,"value":302},{"type":44,"tag":60,"props":879,"children":880},{},[881],{"type":49,"value":882},"no table privileges",{"type":49,"value":884}," on ",{"type":44,"tag":77,"props":886,"children":888},{"className":887},[],[889],{"type":49,"value":179},{"type":49,"value":456},{"type":44,"tag":77,"props":892,"children":894},{"className":893},[],[895],{"type":49,"value":186},{"type":49,"value":897}," (only schema ",{"type":44,"tag":77,"props":899,"children":901},{"className":900},[],[902],{"type":49,"value":903},"USAGE",{"type":49,"value":905},"; only ",{"type":44,"tag":77,"props":907,"children":909},{"className":908},[],[910],{"type":49,"value":911},"postgres",{"type":49,"value":913}," holds table grants). Before the admin root can read a Supabase-internal table, run the narrow grant once (see ",{"type":44,"tag":195,"props":915,"children":916},{},[917],{"type":49,"value":664},{"type":49,"value":919},"). ",{"type":44,"tag":77,"props":921,"children":923},{"className":922},[],[924],{"type":49,"value":925},"asUser",{"type":49,"value":456},{"type":44,"tag":77,"props":928,"children":930},{"className":929},[],[931],{"type":49,"value":932},"asAnon",{"type":49,"value":934}," have no ",{"type":44,"tag":77,"props":936,"children":938},{"className":937},[],[939],{"type":49,"value":940},".supabase",{"type":49,"value":942},", and the primary ",{"type":44,"tag":77,"props":944,"children":946},{"className":945},[],[947],{"type":49,"value":948},"asServiceRole().sql",{"type":49,"value":456},{"type":44,"tag":77,"props":951,"children":953},{"className":952},[],[954],{"type":49,"value":507},{"type":49,"value":956}," stay scoped to ",{"type":44,"tag":195,"props":958,"children":959},{},[960],{"type":49,"value":961},"your",{"type":49,"value":963}," contract.",{"type":44,"tag":86,"props":965,"children":967},{"id":966},"workflow-wire-the-pack-into-the-config",[968],{"type":49,"value":969},"Workflow — Wire the pack into the config",{"type":44,"tag":56,"props":971,"children":972},{},[973,975,981,983,989,991,996,997,1001,1003,1008,1010,1016],{"type":49,"value":974},"The concept: the pack registers the Supabase contract space so your contract can reference it and the planner\u002Fverifier know what Supabase owns. The extension has no ",{"type":44,"tag":77,"props":976,"children":978},{"className":977},[],[979],{"type":49,"value":980},"\u002Fcontrol",{"type":49,"value":982}," subpath yet, so it can't go through the target façade's ",{"type":44,"tag":77,"props":984,"children":986},{"className":985},[],[987],{"type":49,"value":988},"defineConfig({ extensions: [...] })",{"type":49,"value":990}," — it wires into the low-level config's ",{"type":44,"tag":77,"props":992,"children":994},{"className":993},[],[995],{"type":49,"value":360},{"type":49,"value":659},{"type":44,"tag":195,"props":998,"children":999},{},[1000],{"type":49,"value":622},{"type":49,"value":1002},"). The low-level imports below are a ",{"type":44,"tag":60,"props":1004,"children":1005},{},[1006],{"type":49,"value":1007},"deliberate exception",{"type":49,"value":1009}," to the façade-only import rule, forced by that gap; the block mirrors ",{"type":44,"tag":77,"props":1011,"children":1013},{"className":1012},[],[1014],{"type":49,"value":1015},"examples\u002Fsupabase\u002Fprisma-next.config.ts",{"type":49,"value":1017}," verbatim — copy it rather than composing your own:",{"type":44,"tag":1019,"props":1020,"children":1025},"pre",{"className":1021,"code":1022,"language":1023,"meta":1024,"style":1024},"language-typescript shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","\u002F\u002F prisma-next.config.ts\nimport postgresAdapter from '@prisma-next\u002Fadapter-postgres\u002Fcontrol';\nimport { defineConfig } from '@prisma-next\u002Fcli\u002Fconfig-types';\nimport postgresDriver from '@prisma-next\u002Fdriver-postgres\u002Fcontrol';\nimport supabasePack from '@prisma-next\u002Fextension-supabase\u002Fpack';\nimport sql from '@prisma-next\u002Ffamily-sql\u002Fcontrol';\nimport { prismaContract } from '@prisma-next\u002Fsql-contract-psl\u002Fprovider';\nimport postgres from '@prisma-next\u002Ftarget-postgres\u002Fcontrol';\nimport postgresPackRef from '@prisma-next\u002Ftarget-postgres\u002Fpack';\nimport { postgresCreateNamespace } from '@prisma-next\u002Ftarget-postgres\u002Ftypes';\n\nexport default defineConfig({\n  family: sql,\n  target: postgres,\n  adapter: postgresAdapter,\n  driver: postgresDriver,\n  extensions: [supabasePack],\n  contract: prismaContract('.\u002Fsrc\u002Fcontract.prisma', {\n    output: 'src\u002Fcontract.json',\n    target: postgresPackRef,\n    createNamespace: postgresCreateNamespace,\n  }),\n  migrations: { dir: 'migrations' },\n});\n","typescript","",[1026],{"type":44,"tag":77,"props":1027,"children":1028},{"__ignoreMap":1024},[1029,1041,1084,1129,1163,1196,1230,1272,1306,1340,1382,1392,1421,1446,1468,1489,1511,1533,1577,1607,1629,1650,1668,1712],{"type":44,"tag":1030,"props":1031,"children":1034},"span",{"class":1032,"line":1033},"line",1,[1035],{"type":44,"tag":1030,"props":1036,"children":1038},{"style":1037},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[1039],{"type":49,"value":1040},"\u002F\u002F prisma-next.config.ts\n",{"type":44,"tag":1030,"props":1042,"children":1044},{"class":1032,"line":1043},2,[1045,1051,1057,1062,1068,1074,1079],{"type":44,"tag":1030,"props":1046,"children":1048},{"style":1047},"--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic",[1049],{"type":49,"value":1050},"import",{"type":44,"tag":1030,"props":1052,"children":1054},{"style":1053},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[1055],{"type":49,"value":1056}," postgresAdapter ",{"type":44,"tag":1030,"props":1058,"children":1059},{"style":1047},[1060],{"type":49,"value":1061},"from",{"type":44,"tag":1030,"props":1063,"children":1065},{"style":1064},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[1066],{"type":49,"value":1067}," '",{"type":44,"tag":1030,"props":1069,"children":1071},{"style":1070},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[1072],{"type":49,"value":1073},"@prisma-next\u002Fadapter-postgres\u002Fcontrol",{"type":44,"tag":1030,"props":1075,"children":1076},{"style":1064},[1077],{"type":49,"value":1078},"'",{"type":44,"tag":1030,"props":1080,"children":1081},{"style":1064},[1082],{"type":49,"value":1083},";\n",{"type":44,"tag":1030,"props":1085,"children":1087},{"class":1032,"line":1086},3,[1088,1092,1097,1102,1107,1112,1116,1121,1125],{"type":44,"tag":1030,"props":1089,"children":1090},{"style":1047},[1091],{"type":49,"value":1050},{"type":44,"tag":1030,"props":1093,"children":1094},{"style":1064},[1095],{"type":49,"value":1096}," {",{"type":44,"tag":1030,"props":1098,"children":1099},{"style":1053},[1100],{"type":49,"value":1101}," defineConfig",{"type":44,"tag":1030,"props":1103,"children":1104},{"style":1064},[1105],{"type":49,"value":1106}," }",{"type":44,"tag":1030,"props":1108,"children":1109},{"style":1047},[1110],{"type":49,"value":1111}," from",{"type":44,"tag":1030,"props":1113,"children":1114},{"style":1064},[1115],{"type":49,"value":1067},{"type":44,"tag":1030,"props":1117,"children":1118},{"style":1070},[1119],{"type":49,"value":1120},"@prisma-next\u002Fcli\u002Fconfig-types",{"type":44,"tag":1030,"props":1122,"children":1123},{"style":1064},[1124],{"type":49,"value":1078},{"type":44,"tag":1030,"props":1126,"children":1127},{"style":1064},[1128],{"type":49,"value":1083},{"type":44,"tag":1030,"props":1130,"children":1132},{"class":1032,"line":1131},4,[1133,1137,1142,1146,1150,1155,1159],{"type":44,"tag":1030,"props":1134,"children":1135},{"style":1047},[1136],{"type":49,"value":1050},{"type":44,"tag":1030,"props":1138,"children":1139},{"style":1053},[1140],{"type":49,"value":1141}," postgresDriver ",{"type":44,"tag":1030,"props":1143,"children":1144},{"style":1047},[1145],{"type":49,"value":1061},{"type":44,"tag":1030,"props":1147,"children":1148},{"style":1064},[1149],{"type":49,"value":1067},{"type":44,"tag":1030,"props":1151,"children":1152},{"style":1070},[1153],{"type":49,"value":1154},"@prisma-next\u002Fdriver-postgres\u002Fcontrol",{"type":44,"tag":1030,"props":1156,"children":1157},{"style":1064},[1158],{"type":49,"value":1078},{"type":44,"tag":1030,"props":1160,"children":1161},{"style":1064},[1162],{"type":49,"value":1083},{"type":44,"tag":1030,"props":1164,"children":1166},{"class":1032,"line":1165},5,[1167,1171,1176,1180,1184,1188,1192],{"type":44,"tag":1030,"props":1168,"children":1169},{"style":1047},[1170],{"type":49,"value":1050},{"type":44,"tag":1030,"props":1172,"children":1173},{"style":1053},[1174],{"type":49,"value":1175}," supabasePack ",{"type":44,"tag":1030,"props":1177,"children":1178},{"style":1047},[1179],{"type":49,"value":1061},{"type":44,"tag":1030,"props":1181,"children":1182},{"style":1064},[1183],{"type":49,"value":1067},{"type":44,"tag":1030,"props":1185,"children":1186},{"style":1070},[1187],{"type":49,"value":308},{"type":44,"tag":1030,"props":1189,"children":1190},{"style":1064},[1191],{"type":49,"value":1078},{"type":44,"tag":1030,"props":1193,"children":1194},{"style":1064},[1195],{"type":49,"value":1083},{"type":44,"tag":1030,"props":1197,"children":1199},{"class":1032,"line":1198},6,[1200,1204,1209,1213,1217,1222,1226],{"type":44,"tag":1030,"props":1201,"children":1202},{"style":1047},[1203],{"type":49,"value":1050},{"type":44,"tag":1030,"props":1205,"children":1206},{"style":1053},[1207],{"type":49,"value":1208}," sql ",{"type":44,"tag":1030,"props":1210,"children":1211},{"style":1047},[1212],{"type":49,"value":1061},{"type":44,"tag":1030,"props":1214,"children":1215},{"style":1064},[1216],{"type":49,"value":1067},{"type":44,"tag":1030,"props":1218,"children":1219},{"style":1070},[1220],{"type":49,"value":1221},"@prisma-next\u002Ffamily-sql\u002Fcontrol",{"type":44,"tag":1030,"props":1223,"children":1224},{"style":1064},[1225],{"type":49,"value":1078},{"type":44,"tag":1030,"props":1227,"children":1228},{"style":1064},[1229],{"type":49,"value":1083},{"type":44,"tag":1030,"props":1231,"children":1233},{"class":1032,"line":1232},7,[1234,1238,1242,1247,1251,1255,1259,1264,1268],{"type":44,"tag":1030,"props":1235,"children":1236},{"style":1047},[1237],{"type":49,"value":1050},{"type":44,"tag":1030,"props":1239,"children":1240},{"style":1064},[1241],{"type":49,"value":1096},{"type":44,"tag":1030,"props":1243,"children":1244},{"style":1053},[1245],{"type":49,"value":1246}," prismaContract",{"type":44,"tag":1030,"props":1248,"children":1249},{"style":1064},[1250],{"type":49,"value":1106},{"type":44,"tag":1030,"props":1252,"children":1253},{"style":1047},[1254],{"type":49,"value":1111},{"type":44,"tag":1030,"props":1256,"children":1257},{"style":1064},[1258],{"type":49,"value":1067},{"type":44,"tag":1030,"props":1260,"children":1261},{"style":1070},[1262],{"type":49,"value":1263},"@prisma-next\u002Fsql-contract-psl\u002Fprovider",{"type":44,"tag":1030,"props":1265,"children":1266},{"style":1064},[1267],{"type":49,"value":1078},{"type":44,"tag":1030,"props":1269,"children":1270},{"style":1064},[1271],{"type":49,"value":1083},{"type":44,"tag":1030,"props":1273,"children":1275},{"class":1032,"line":1274},8,[1276,1280,1285,1289,1293,1298,1302],{"type":44,"tag":1030,"props":1277,"children":1278},{"style":1047},[1279],{"type":49,"value":1050},{"type":44,"tag":1030,"props":1281,"children":1282},{"style":1053},[1283],{"type":49,"value":1284}," postgres ",{"type":44,"tag":1030,"props":1286,"children":1287},{"style":1047},[1288],{"type":49,"value":1061},{"type":44,"tag":1030,"props":1290,"children":1291},{"style":1064},[1292],{"type":49,"value":1067},{"type":44,"tag":1030,"props":1294,"children":1295},{"style":1070},[1296],{"type":49,"value":1297},"@prisma-next\u002Ftarget-postgres\u002Fcontrol",{"type":44,"tag":1030,"props":1299,"children":1300},{"style":1064},[1301],{"type":49,"value":1078},{"type":44,"tag":1030,"props":1303,"children":1304},{"style":1064},[1305],{"type":49,"value":1083},{"type":44,"tag":1030,"props":1307,"children":1309},{"class":1032,"line":1308},9,[1310,1314,1319,1323,1327,1332,1336],{"type":44,"tag":1030,"props":1311,"children":1312},{"style":1047},[1313],{"type":49,"value":1050},{"type":44,"tag":1030,"props":1315,"children":1316},{"style":1053},[1317],{"type":49,"value":1318}," postgresPackRef ",{"type":44,"tag":1030,"props":1320,"children":1321},{"style":1047},[1322],{"type":49,"value":1061},{"type":44,"tag":1030,"props":1324,"children":1325},{"style":1064},[1326],{"type":49,"value":1067},{"type":44,"tag":1030,"props":1328,"children":1329},{"style":1070},[1330],{"type":49,"value":1331},"@prisma-next\u002Ftarget-postgres\u002Fpack",{"type":44,"tag":1030,"props":1333,"children":1334},{"style":1064},[1335],{"type":49,"value":1078},{"type":44,"tag":1030,"props":1337,"children":1338},{"style":1064},[1339],{"type":49,"value":1083},{"type":44,"tag":1030,"props":1341,"children":1343},{"class":1032,"line":1342},10,[1344,1348,1352,1357,1361,1365,1369,1374,1378],{"type":44,"tag":1030,"props":1345,"children":1346},{"style":1047},[1347],{"type":49,"value":1050},{"type":44,"tag":1030,"props":1349,"children":1350},{"style":1064},[1351],{"type":49,"value":1096},{"type":44,"tag":1030,"props":1353,"children":1354},{"style":1053},[1355],{"type":49,"value":1356}," postgresCreateNamespace",{"type":44,"tag":1030,"props":1358,"children":1359},{"style":1064},[1360],{"type":49,"value":1106},{"type":44,"tag":1030,"props":1362,"children":1363},{"style":1047},[1364],{"type":49,"value":1111},{"type":44,"tag":1030,"props":1366,"children":1367},{"style":1064},[1368],{"type":49,"value":1067},{"type":44,"tag":1030,"props":1370,"children":1371},{"style":1070},[1372],{"type":49,"value":1373},"@prisma-next\u002Ftarget-postgres\u002Ftypes",{"type":44,"tag":1030,"props":1375,"children":1376},{"style":1064},[1377],{"type":49,"value":1078},{"type":44,"tag":1030,"props":1379,"children":1380},{"style":1064},[1381],{"type":49,"value":1083},{"type":44,"tag":1030,"props":1383,"children":1385},{"class":1032,"line":1384},11,[1386],{"type":44,"tag":1030,"props":1387,"children":1389},{"emptyLinePlaceholder":1388},true,[1390],{"type":49,"value":1391},"\n",{"type":44,"tag":1030,"props":1393,"children":1395},{"class":1032,"line":1394},12,[1396,1401,1406,1411,1416],{"type":44,"tag":1030,"props":1397,"children":1398},{"style":1047},[1399],{"type":49,"value":1400},"export",{"type":44,"tag":1030,"props":1402,"children":1403},{"style":1047},[1404],{"type":49,"value":1405}," default",{"type":44,"tag":1030,"props":1407,"children":1409},{"style":1408},"--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF",[1410],{"type":49,"value":1101},{"type":44,"tag":1030,"props":1412,"children":1413},{"style":1053},[1414],{"type":49,"value":1415},"(",{"type":44,"tag":1030,"props":1417,"children":1418},{"style":1064},[1419],{"type":49,"value":1420},"{\n",{"type":44,"tag":1030,"props":1422,"children":1424},{"class":1032,"line":1423},13,[1425,1431,1436,1441],{"type":44,"tag":1030,"props":1426,"children":1428},{"style":1427},"--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178",[1429],{"type":49,"value":1430},"  family",{"type":44,"tag":1030,"props":1432,"children":1433},{"style":1064},[1434],{"type":49,"value":1435},":",{"type":44,"tag":1030,"props":1437,"children":1438},{"style":1053},[1439],{"type":49,"value":1440}," sql",{"type":44,"tag":1030,"props":1442,"children":1443},{"style":1064},[1444],{"type":49,"value":1445},",\n",{"type":44,"tag":1030,"props":1447,"children":1449},{"class":1032,"line":1448},14,[1450,1455,1459,1464],{"type":44,"tag":1030,"props":1451,"children":1452},{"style":1427},[1453],{"type":49,"value":1454},"  target",{"type":44,"tag":1030,"props":1456,"children":1457},{"style":1064},[1458],{"type":49,"value":1435},{"type":44,"tag":1030,"props":1460,"children":1461},{"style":1053},[1462],{"type":49,"value":1463}," postgres",{"type":44,"tag":1030,"props":1465,"children":1466},{"style":1064},[1467],{"type":49,"value":1445},{"type":44,"tag":1030,"props":1469,"children":1470},{"class":1032,"line":30},[1471,1476,1480,1485],{"type":44,"tag":1030,"props":1472,"children":1473},{"style":1427},[1474],{"type":49,"value":1475},"  adapter",{"type":44,"tag":1030,"props":1477,"children":1478},{"style":1064},[1479],{"type":49,"value":1435},{"type":44,"tag":1030,"props":1481,"children":1482},{"style":1053},[1483],{"type":49,"value":1484}," postgresAdapter",{"type":44,"tag":1030,"props":1486,"children":1487},{"style":1064},[1488],{"type":49,"value":1445},{"type":44,"tag":1030,"props":1490,"children":1492},{"class":1032,"line":1491},16,[1493,1498,1502,1507],{"type":44,"tag":1030,"props":1494,"children":1495},{"style":1427},[1496],{"type":49,"value":1497},"  driver",{"type":44,"tag":1030,"props":1499,"children":1500},{"style":1064},[1501],{"type":49,"value":1435},{"type":44,"tag":1030,"props":1503,"children":1504},{"style":1053},[1505],{"type":49,"value":1506}," postgresDriver",{"type":44,"tag":1030,"props":1508,"children":1509},{"style":1064},[1510],{"type":49,"value":1445},{"type":44,"tag":1030,"props":1512,"children":1514},{"class":1032,"line":1513},17,[1515,1520,1524,1529],{"type":44,"tag":1030,"props":1516,"children":1517},{"style":1427},[1518],{"type":49,"value":1519},"  extensions",{"type":44,"tag":1030,"props":1521,"children":1522},{"style":1064},[1523],{"type":49,"value":1435},{"type":44,"tag":1030,"props":1525,"children":1526},{"style":1053},[1527],{"type":49,"value":1528}," [supabasePack]",{"type":44,"tag":1030,"props":1530,"children":1531},{"style":1064},[1532],{"type":49,"value":1445},{"type":44,"tag":1030,"props":1534,"children":1536},{"class":1032,"line":1535},18,[1537,1542,1546,1550,1554,1558,1563,1567,1572],{"type":44,"tag":1030,"props":1538,"children":1539},{"style":1427},[1540],{"type":49,"value":1541},"  contract",{"type":44,"tag":1030,"props":1543,"children":1544},{"style":1064},[1545],{"type":49,"value":1435},{"type":44,"tag":1030,"props":1547,"children":1548},{"style":1408},[1549],{"type":49,"value":1246},{"type":44,"tag":1030,"props":1551,"children":1552},{"style":1053},[1553],{"type":49,"value":1415},{"type":44,"tag":1030,"props":1555,"children":1556},{"style":1064},[1557],{"type":49,"value":1078},{"type":44,"tag":1030,"props":1559,"children":1560},{"style":1070},[1561],{"type":49,"value":1562},".\u002Fsrc\u002Fcontract.prisma",{"type":44,"tag":1030,"props":1564,"children":1565},{"style":1064},[1566],{"type":49,"value":1078},{"type":44,"tag":1030,"props":1568,"children":1569},{"style":1064},[1570],{"type":49,"value":1571},",",{"type":44,"tag":1030,"props":1573,"children":1574},{"style":1064},[1575],{"type":49,"value":1576}," {\n",{"type":44,"tag":1030,"props":1578,"children":1580},{"class":1032,"line":1579},19,[1581,1586,1590,1594,1599,1603],{"type":44,"tag":1030,"props":1582,"children":1583},{"style":1427},[1584],{"type":49,"value":1585},"    output",{"type":44,"tag":1030,"props":1587,"children":1588},{"style":1064},[1589],{"type":49,"value":1435},{"type":44,"tag":1030,"props":1591,"children":1592},{"style":1064},[1593],{"type":49,"value":1067},{"type":44,"tag":1030,"props":1595,"children":1596},{"style":1070},[1597],{"type":49,"value":1598},"src\u002Fcontract.json",{"type":44,"tag":1030,"props":1600,"children":1601},{"style":1064},[1602],{"type":49,"value":1078},{"type":44,"tag":1030,"props":1604,"children":1605},{"style":1064},[1606],{"type":49,"value":1445},{"type":44,"tag":1030,"props":1608,"children":1610},{"class":1032,"line":1609},20,[1611,1616,1620,1625],{"type":44,"tag":1030,"props":1612,"children":1613},{"style":1427},[1614],{"type":49,"value":1615},"    target",{"type":44,"tag":1030,"props":1617,"children":1618},{"style":1064},[1619],{"type":49,"value":1435},{"type":44,"tag":1030,"props":1621,"children":1622},{"style":1053},[1623],{"type":49,"value":1624}," postgresPackRef",{"type":44,"tag":1030,"props":1626,"children":1627},{"style":1064},[1628],{"type":49,"value":1445},{"type":44,"tag":1030,"props":1630,"children":1632},{"class":1032,"line":1631},21,[1633,1638,1642,1646],{"type":44,"tag":1030,"props":1634,"children":1635},{"style":1427},[1636],{"type":49,"value":1637},"    createNamespace",{"type":44,"tag":1030,"props":1639,"children":1640},{"style":1064},[1641],{"type":49,"value":1435},{"type":44,"tag":1030,"props":1643,"children":1644},{"style":1053},[1645],{"type":49,"value":1356},{"type":44,"tag":1030,"props":1647,"children":1648},{"style":1064},[1649],{"type":49,"value":1445},{"type":44,"tag":1030,"props":1651,"children":1653},{"class":1032,"line":1652},22,[1654,1659,1664],{"type":44,"tag":1030,"props":1655,"children":1656},{"style":1064},[1657],{"type":49,"value":1658},"  }",{"type":44,"tag":1030,"props":1660,"children":1661},{"style":1053},[1662],{"type":49,"value":1663},")",{"type":44,"tag":1030,"props":1665,"children":1666},{"style":1064},[1667],{"type":49,"value":1445},{"type":44,"tag":1030,"props":1669,"children":1671},{"class":1032,"line":1670},23,[1672,1677,1681,1685,1690,1694,1698,1703,1707],{"type":44,"tag":1030,"props":1673,"children":1674},{"style":1427},[1675],{"type":49,"value":1676},"  migrations",{"type":44,"tag":1030,"props":1678,"children":1679},{"style":1064},[1680],{"type":49,"value":1435},{"type":44,"tag":1030,"props":1682,"children":1683},{"style":1064},[1684],{"type":49,"value":1096},{"type":44,"tag":1030,"props":1686,"children":1687},{"style":1427},[1688],{"type":49,"value":1689}," dir",{"type":44,"tag":1030,"props":1691,"children":1692},{"style":1064},[1693],{"type":49,"value":1435},{"type":44,"tag":1030,"props":1695,"children":1696},{"style":1064},[1697],{"type":49,"value":1067},{"type":44,"tag":1030,"props":1699,"children":1700},{"style":1070},[1701],{"type":49,"value":1702},"migrations",{"type":44,"tag":1030,"props":1704,"children":1705},{"style":1064},[1706],{"type":49,"value":1078},{"type":44,"tag":1030,"props":1708,"children":1709},{"style":1064},[1710],{"type":49,"value":1711}," },\n",{"type":44,"tag":1030,"props":1713,"children":1715},{"class":1032,"line":1714},24,[1716,1721,1725],{"type":44,"tag":1030,"props":1717,"children":1718},{"style":1064},[1719],{"type":49,"value":1720},"}",{"type":44,"tag":1030,"props":1722,"children":1723},{"style":1053},[1724],{"type":49,"value":1663},{"type":44,"tag":1030,"props":1726,"children":1727},{"style":1064},[1728],{"type":49,"value":1083},{"type":44,"tag":86,"props":1730,"children":1732},{"id":1731},"workflow-contract-fk-into-authusers-rls-policies",[1733,1735,1740],{"type":49,"value":1734},"Workflow — Contract: FK into ",{"type":44,"tag":77,"props":1736,"children":1738},{"className":1737},[],[1739],{"type":49,"value":166},{"type":49,"value":1741}," + RLS policies",{"type":44,"tag":56,"props":1743,"children":1744},{},[1745,1747,1752,1754,1759,1760,1765,1767,1773,1775,1780,1782,1788,1790,1796,1798,1803,1805,1811],{"type":49,"value":1746},"The concept: your models live in your namespaces (",{"type":44,"tag":77,"props":1748,"children":1750},{"className":1749},[],[1751],{"type":49,"value":637},{"type":49,"value":1753},"); Supabase's live in the pack's (",{"type":44,"tag":77,"props":1755,"children":1757},{"className":1756},[],[1758],{"type":49,"value":14},{"type":49,"value":114},{"type":44,"tag":77,"props":1761,"children":1763},{"className":1762},[],[1764],{"type":49,"value":323},{"type":49,"value":1766},"). A relation field typed ",{"type":44,"tag":77,"props":1768,"children":1770},{"className":1769},[],[1771],{"type":49,"value":1772},"supabase:auth.AuthUser",{"type":49,"value":1774}," is a ",{"type":44,"tag":60,"props":1776,"children":1777},{},[1778],{"type":49,"value":1779},"cross-space FK",{"type":49,"value":1781}," — the planner emits ",{"type":44,"tag":77,"props":1783,"children":1785},{"className":1784},[],[1786],{"type":49,"value":1787},"REFERENCES \"auth\".\"users\"(\"id\")",{"type":49,"value":1789},", and the target table is verified, never migrated. RLS policies are top-level ",{"type":44,"tag":77,"props":1791,"children":1793},{"className":1792},[],[1794],{"type":49,"value":1795},"policy_\u003Coperation>",{"type":49,"value":1797}," blocks in the same namespace as their target model, and the target model must opt in with ",{"type":44,"tag":77,"props":1799,"children":1801},{"className":1800},[],[1802],{"type":49,"value":120},{"type":49,"value":1804},". Mirror ",{"type":44,"tag":77,"props":1806,"children":1808},{"className":1807},[],[1809],{"type":49,"value":1810},"examples\u002Fsupabase\u002Fsrc\u002Fcontract.prisma",{"type":49,"value":1435},{"type":44,"tag":1019,"props":1813,"children":1816},{"className":1814,"code":1815,"language":8,"meta":1024,"style":1024},"language-prisma shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","namespace public {\n  model Profile {\n    id       Uuid   @id @default(uuid())\n    username String\n    userId   Uuid   @unique\n    user     supabase:auth.AuthUser @relation(fields: [userId], references: [id], onDelete: Cascade)\n    @@map(\"profile\")\n    @@rls\n  }\n\n  \u002F\u002F authenticated may read only their own profile.\n  policy_select profile_owner_read {\n    target = Profile\n    roles  = [authenticated]\n    using  = \"\\\"userId\\\"::uuid = auth.uid()\"\n  }\n\n  \u002F\u002F anon may read every profile (a public directory listing).\n  policy_select profile_public_read {\n    target = Profile\n    roles  = [anon]\n    using  = \"true\"\n  }\n\n  \u002F\u002F authenticated may update only their own profile, and may not\n  \u002F\u002F reassign it to another owner (WITH CHECK).\n  policy_update profile_owner_write {\n    target    = Profile\n    roles     = [authenticated]\n    using     = \"\\\"userId\\\"::uuid = auth.uid()\"\n    withCheck = \"\\\"userId\\\"::uuid = auth.uid()\"\n  }\n}\n",[1817],{"type":44,"tag":77,"props":1818,"children":1819},{"__ignoreMap":1024},[1820,1828,1836,1844,1852,1860,1868,1876,1884,1892,1899,1907,1915,1923,1931,1939,1946,1953,1961,1969,1976,1984,1992,1999,2006,2015,2024,2033,2042,2051,2060,2069,2077],{"type":44,"tag":1030,"props":1821,"children":1822},{"class":1032,"line":1033},[1823],{"type":44,"tag":1030,"props":1824,"children":1825},{},[1826],{"type":49,"value":1827},"namespace public {\n",{"type":44,"tag":1030,"props":1829,"children":1830},{"class":1032,"line":1043},[1831],{"type":44,"tag":1030,"props":1832,"children":1833},{},[1834],{"type":49,"value":1835},"  model Profile {\n",{"type":44,"tag":1030,"props":1837,"children":1838},{"class":1032,"line":1086},[1839],{"type":44,"tag":1030,"props":1840,"children":1841},{},[1842],{"type":49,"value":1843},"    id       Uuid   @id @default(uuid())\n",{"type":44,"tag":1030,"props":1845,"children":1846},{"class":1032,"line":1131},[1847],{"type":44,"tag":1030,"props":1848,"children":1849},{},[1850],{"type":49,"value":1851},"    username String\n",{"type":44,"tag":1030,"props":1853,"children":1854},{"class":1032,"line":1165},[1855],{"type":44,"tag":1030,"props":1856,"children":1857},{},[1858],{"type":49,"value":1859},"    userId   Uuid   @unique\n",{"type":44,"tag":1030,"props":1861,"children":1862},{"class":1032,"line":1198},[1863],{"type":44,"tag":1030,"props":1864,"children":1865},{},[1866],{"type":49,"value":1867},"    user     supabase:auth.AuthUser @relation(fields: [userId], references: [id], onDelete: Cascade)\n",{"type":44,"tag":1030,"props":1869,"children":1870},{"class":1032,"line":1232},[1871],{"type":44,"tag":1030,"props":1872,"children":1873},{},[1874],{"type":49,"value":1875},"    @@map(\"profile\")\n",{"type":44,"tag":1030,"props":1877,"children":1878},{"class":1032,"line":1274},[1879],{"type":44,"tag":1030,"props":1880,"children":1881},{},[1882],{"type":49,"value":1883},"    @@rls\n",{"type":44,"tag":1030,"props":1885,"children":1886},{"class":1032,"line":1308},[1887],{"type":44,"tag":1030,"props":1888,"children":1889},{},[1890],{"type":49,"value":1891},"  }\n",{"type":44,"tag":1030,"props":1893,"children":1894},{"class":1032,"line":1342},[1895],{"type":44,"tag":1030,"props":1896,"children":1897},{"emptyLinePlaceholder":1388},[1898],{"type":49,"value":1391},{"type":44,"tag":1030,"props":1900,"children":1901},{"class":1032,"line":1384},[1902],{"type":44,"tag":1030,"props":1903,"children":1904},{},[1905],{"type":49,"value":1906},"  \u002F\u002F authenticated may read only their own profile.\n",{"type":44,"tag":1030,"props":1908,"children":1909},{"class":1032,"line":1394},[1910],{"type":44,"tag":1030,"props":1911,"children":1912},{},[1913],{"type":49,"value":1914},"  policy_select profile_owner_read {\n",{"type":44,"tag":1030,"props":1916,"children":1917},{"class":1032,"line":1423},[1918],{"type":44,"tag":1030,"props":1919,"children":1920},{},[1921],{"type":49,"value":1922},"    target = Profile\n",{"type":44,"tag":1030,"props":1924,"children":1925},{"class":1032,"line":1448},[1926],{"type":44,"tag":1030,"props":1927,"children":1928},{},[1929],{"type":49,"value":1930},"    roles  = [authenticated]\n",{"type":44,"tag":1030,"props":1932,"children":1933},{"class":1032,"line":30},[1934],{"type":44,"tag":1030,"props":1935,"children":1936},{},[1937],{"type":49,"value":1938},"    using  = \"\\\"userId\\\"::uuid = auth.uid()\"\n",{"type":44,"tag":1030,"props":1940,"children":1941},{"class":1032,"line":1491},[1942],{"type":44,"tag":1030,"props":1943,"children":1944},{},[1945],{"type":49,"value":1891},{"type":44,"tag":1030,"props":1947,"children":1948},{"class":1032,"line":1513},[1949],{"type":44,"tag":1030,"props":1950,"children":1951},{"emptyLinePlaceholder":1388},[1952],{"type":49,"value":1391},{"type":44,"tag":1030,"props":1954,"children":1955},{"class":1032,"line":1535},[1956],{"type":44,"tag":1030,"props":1957,"children":1958},{},[1959],{"type":49,"value":1960},"  \u002F\u002F anon may read every profile (a public directory listing).\n",{"type":44,"tag":1030,"props":1962,"children":1963},{"class":1032,"line":1579},[1964],{"type":44,"tag":1030,"props":1965,"children":1966},{},[1967],{"type":49,"value":1968},"  policy_select profile_public_read {\n",{"type":44,"tag":1030,"props":1970,"children":1971},{"class":1032,"line":1609},[1972],{"type":44,"tag":1030,"props":1973,"children":1974},{},[1975],{"type":49,"value":1922},{"type":44,"tag":1030,"props":1977,"children":1978},{"class":1032,"line":1631},[1979],{"type":44,"tag":1030,"props":1980,"children":1981},{},[1982],{"type":49,"value":1983},"    roles  = [anon]\n",{"type":44,"tag":1030,"props":1985,"children":1986},{"class":1032,"line":1652},[1987],{"type":44,"tag":1030,"props":1988,"children":1989},{},[1990],{"type":49,"value":1991},"    using  = \"true\"\n",{"type":44,"tag":1030,"props":1993,"children":1994},{"class":1032,"line":1670},[1995],{"type":44,"tag":1030,"props":1996,"children":1997},{},[1998],{"type":49,"value":1891},{"type":44,"tag":1030,"props":2000,"children":2001},{"class":1032,"line":1714},[2002],{"type":44,"tag":1030,"props":2003,"children":2004},{"emptyLinePlaceholder":1388},[2005],{"type":49,"value":1391},{"type":44,"tag":1030,"props":2007,"children":2009},{"class":1032,"line":2008},25,[2010],{"type":44,"tag":1030,"props":2011,"children":2012},{},[2013],{"type":49,"value":2014},"  \u002F\u002F authenticated may update only their own profile, and may not\n",{"type":44,"tag":1030,"props":2016,"children":2018},{"class":1032,"line":2017},26,[2019],{"type":44,"tag":1030,"props":2020,"children":2021},{},[2022],{"type":49,"value":2023},"  \u002F\u002F reassign it to another owner (WITH CHECK).\n",{"type":44,"tag":1030,"props":2025,"children":2027},{"class":1032,"line":2026},27,[2028],{"type":44,"tag":1030,"props":2029,"children":2030},{},[2031],{"type":49,"value":2032},"  policy_update profile_owner_write {\n",{"type":44,"tag":1030,"props":2034,"children":2036},{"class":1032,"line":2035},28,[2037],{"type":44,"tag":1030,"props":2038,"children":2039},{},[2040],{"type":49,"value":2041},"    target    = Profile\n",{"type":44,"tag":1030,"props":2043,"children":2045},{"class":1032,"line":2044},29,[2046],{"type":44,"tag":1030,"props":2047,"children":2048},{},[2049],{"type":49,"value":2050},"    roles     = [authenticated]\n",{"type":44,"tag":1030,"props":2052,"children":2054},{"class":1032,"line":2053},30,[2055],{"type":44,"tag":1030,"props":2056,"children":2057},{},[2058],{"type":49,"value":2059},"    using     = \"\\\"userId\\\"::uuid = auth.uid()\"\n",{"type":44,"tag":1030,"props":2061,"children":2063},{"class":1032,"line":2062},31,[2064],{"type":44,"tag":1030,"props":2065,"children":2066},{},[2067],{"type":49,"value":2068},"    withCheck = \"\\\"userId\\\"::uuid = auth.uid()\"\n",{"type":44,"tag":1030,"props":2070,"children":2072},{"class":1032,"line":2071},32,[2073],{"type":44,"tag":1030,"props":2074,"children":2075},{},[2076],{"type":49,"value":1891},{"type":44,"tag":1030,"props":2078,"children":2080},{"class":1032,"line":2079},33,[2081],{"type":44,"tag":1030,"props":2082,"children":2083},{},[2084],{"type":49,"value":2085},"}\n",{"type":44,"tag":56,"props":2087,"children":2088},{},[2089,2091,2097,2099,2105,2107,2113,2115,2120],{"type":49,"value":2090},"The ",{"type":44,"tag":77,"props":2092,"children":2094},{"className":2093},[],[2095],{"type":49,"value":2096},"Uuid",{"type":49,"value":2098}," constructor selects native UUID storage in type position. The legacy ",{"type":44,"tag":77,"props":2100,"children":2102},{"className":2101},[],[2103],{"type":49,"value":2104},"@db.Uuid",{"type":49,"value":2106}," spelling is removed; rewrite any ",{"type":44,"tag":77,"props":2108,"children":2110},{"className":2109},[],[2111],{"type":49,"value":2112},"String @db.Uuid",{"type":49,"value":2114}," alias or field as ",{"type":44,"tag":77,"props":2116,"children":2118},{"className":2117},[],[2119],{"type":49,"value":2096},{"type":49,"value":2121}," before emitting.",{"type":44,"tag":56,"props":2123,"children":2124},{},[2125],{"type":49,"value":2126},"The pieces:",{"type":44,"tag":93,"props":2128,"children":2129},{},[2130,2241,2292,2325],{"type":44,"tag":97,"props":2131,"children":2132},{},[2133,2138,2140,2145,2146,2152,2153,2159,2160,2166,2167,2173,2175,2181,2182,2188,2190,2196,2198,2203,2204,2209,2210,2215,2217,2223,2225,2231,2233,2239],{"type":44,"tag":60,"props":2134,"children":2135},{},[2136],{"type":49,"value":2137},"Per-operation policy blocks",{"type":49,"value":2139},": ",{"type":44,"tag":77,"props":2141,"children":2143},{"className":2142},[],[2144],{"type":49,"value":112},{"type":49,"value":114},{"type":44,"tag":77,"props":2147,"children":2149},{"className":2148},[],[2150],{"type":49,"value":2151},"policy_insert",{"type":49,"value":114},{"type":44,"tag":77,"props":2154,"children":2156},{"className":2155},[],[2157],{"type":49,"value":2158},"policy_update",{"type":49,"value":114},{"type":44,"tag":77,"props":2161,"children":2163},{"className":2162},[],[2164],{"type":49,"value":2165},"policy_delete",{"type":49,"value":114},{"type":44,"tag":77,"props":2168,"children":2170},{"className":2169},[],[2171],{"type":49,"value":2172},"policy_all",{"type":49,"value":2174},". Body is ",{"type":44,"tag":77,"props":2176,"children":2178},{"className":2177},[],[2179],{"type":49,"value":2180},"key = value",{"type":49,"value":2139},{"type":44,"tag":77,"props":2183,"children":2185},{"className":2184},[],[2186],{"type":49,"value":2187},"target",{"type":49,"value":2189}," (a model in this namespace), ",{"type":44,"tag":77,"props":2191,"children":2193},{"className":2192},[],[2194],{"type":49,"value":2195},"roles",{"type":49,"value":2197}," (resolve against the composed contract — the pack supplies ",{"type":44,"tag":77,"props":2199,"children":2201},{"className":2200},[],[2202],{"type":49,"value":331},{"type":49,"value":456},{"type":44,"tag":77,"props":2205,"children":2207},{"className":2206},[],[2208],{"type":49,"value":338},{"type":49,"value":456},{"type":44,"tag":77,"props":2211,"children":2213},{"className":2212},[],[2214],{"type":49,"value":345},{"type":49,"value":2216},"), ",{"type":44,"tag":77,"props":2218,"children":2220},{"className":2219},[],[2221],{"type":49,"value":2222},"using",{"type":49,"value":2224},", and (for write operations) ",{"type":44,"tag":77,"props":2226,"children":2228},{"className":2227},[],[2229],{"type":49,"value":2230},"withCheck",{"type":49,"value":2232},". Multiple permissive policies per ",{"type":44,"tag":77,"props":2234,"children":2236},{"className":2235},[],[2237],{"type":49,"value":2238},"(target, operation)",{"type":49,"value":2240}," are valid — Postgres ORs them.",{"type":44,"tag":97,"props":2242,"children":2243},{},[2244,2254,2256,2262,2264,2269,2271,2277,2279,2284,2285,2290],{"type":44,"tag":60,"props":2245,"children":2246},{},[2247,2252],{"type":44,"tag":77,"props":2248,"children":2250},{"className":2249},[],[2251],{"type":49,"value":120},{"type":49,"value":2253}," is required on policy targets.",{"type":49,"value":2255}," A ",{"type":44,"tag":77,"props":2257,"children":2259},{"className":2258},[],[2260],{"type":49,"value":2261},"policy_*",{"type":49,"value":2263}," block whose target model lacks ",{"type":44,"tag":77,"props":2265,"children":2267},{"className":2266},[],[2268],{"type":49,"value":120},{"type":49,"value":2270}," fails emit with ",{"type":44,"tag":77,"props":2272,"children":2274},{"className":2273},[],[2275],{"type":49,"value":2276},"PSL_EXTENSION_TARGET_MODEL_MISSING_ATTRIBUTE",{"type":49,"value":2278},". A model with ",{"type":44,"tag":77,"props":2280,"children":2282},{"className":2281},[],[2283],{"type":49,"value":120},{"type":49,"value":317},{"type":44,"tag":195,"props":2286,"children":2287},{},[2288],{"type":49,"value":2289},"no",{"type":49,"value":2291}," policies is also meaningful: RLS enabled, deny-all.",{"type":44,"tag":97,"props":2293,"children":2294},{},[2295,2300,2302,2308,2310,2315,2317,2323],{"type":44,"tag":60,"props":2296,"children":2297},{},[2298],{"type":49,"value":2299},"Predicates are verbatim SQL strings.",{"type":49,"value":2301}," Quote camelCase column names inside them (",{"type":44,"tag":77,"props":2303,"children":2305},{"className":2304},[],[2306],{"type":49,"value":2307},"\\\"userId\\\"",{"type":49,"value":2309},"), and cast where needed — ",{"type":44,"tag":77,"props":2311,"children":2313},{"className":2312},[],[2314],{"type":49,"value":127},{"type":49,"value":2316}," returns ",{"type":44,"tag":77,"props":2318,"children":2320},{"className":2319},[],[2321],{"type":49,"value":2322},"uuid",{"type":49,"value":2324},". Renames in your contract do not rewrite predicate bodies.",{"type":44,"tag":97,"props":2326,"children":2327},{},[2328,2333,2334,2340,2342,2348,2349,2355,2356,2362,2363,2369,2370,2376,2377,2383,2384,2390],{"type":44,"tag":60,"props":2329,"children":2330},{},[2331],{"type":49,"value":2332},"TS-builder parity exists.",{"type":49,"value":302},{"type":44,"tag":77,"props":2335,"children":2337},{"className":2336},[],[2338],{"type":49,"value":2339},"@prisma-next\u002Fpostgres\u002Fcontract-builder",{"type":49,"value":2341}," exports ",{"type":44,"tag":77,"props":2343,"children":2345},{"className":2344},[],[2346],{"type":49,"value":2347},"policySelect",{"type":49,"value":456},{"type":44,"tag":77,"props":2350,"children":2352},{"className":2351},[],[2353],{"type":49,"value":2354},"policyInsert",{"type":49,"value":456},{"type":44,"tag":77,"props":2357,"children":2359},{"className":2358},[],[2360],{"type":49,"value":2361},"policyUpdate",{"type":49,"value":456},{"type":44,"tag":77,"props":2364,"children":2366},{"className":2365},[],[2367],{"type":49,"value":2368},"policyDelete",{"type":49,"value":456},{"type":44,"tag":77,"props":2371,"children":2373},{"className":2372},[],[2374],{"type":49,"value":2375},"policyAll",{"type":49,"value":114},{"type":44,"tag":77,"props":2378,"children":2380},{"className":2379},[],[2381],{"type":49,"value":2382},"rlsEnabled(Model)",{"type":49,"value":523},{"type":44,"tag":77,"props":2385,"children":2387},{"className":2386},[],[2388],{"type":49,"value":2389},"role('anon')",{"type":49,"value":2391}," — mirroring the PSL lowering key-for-key (identical emitted wire names). PSL is the canonical path shown here.",{"type":44,"tag":56,"props":2393,"children":2394},{},[2395,2397,2403,2405,2410,2412,2418,2420,2426,2428,2438],{"type":49,"value":2396},"Emit + migrate as usual (",{"type":44,"tag":77,"props":2398,"children":2400},{"className":2399},[],[2401],{"type":49,"value":2402},"prisma-next contract emit",{"type":49,"value":2404},", then ",{"type":44,"tag":77,"props":2406,"children":2408},{"className":2407},[],[2409],{"type":49,"value":274},{"type":49,"value":2411},"). The plan creates your table, its FK, ",{"type":44,"tag":77,"props":2413,"children":2415},{"className":2414},[],[2416],{"type":49,"value":2417},"ENABLE ROW LEVEL SECURITY",{"type":49,"value":2419},", and the ",{"type":44,"tag":77,"props":2421,"children":2423},{"className":2422},[],[2424],{"type":49,"value":2425},"CREATE POLICY",{"type":49,"value":2427}," statements — and ",{"type":44,"tag":60,"props":2429,"children":2430},{},[2431,2433],{"type":49,"value":2432},"no DDL for ",{"type":44,"tag":77,"props":2434,"children":2436},{"className":2435},[],[2437],{"type":49,"value":179},{"type":49,"value":201},{"type":44,"tag":86,"props":2440,"children":2442},{"id":2441},"workflow-dbts-with-the-supabase-factory",[2443,2445,2450,2452,2457],{"type":49,"value":2444},"Workflow — ",{"type":44,"tag":77,"props":2446,"children":2448},{"className":2447},[],[2449],{"type":49,"value":233},{"type":49,"value":2451}," with the ",{"type":44,"tag":77,"props":2453,"children":2455},{"className":2454},[],[2456],{"type":49,"value":82},{"type":49,"value":2458}," factory",{"type":44,"tag":56,"props":2460,"children":2461},{},[2462,2464,2470,2472,2477,2479,2485,2487,2492,2494,2499],{"type":49,"value":2463},"The concept: instead of the stock ",{"type":44,"tag":77,"props":2465,"children":2467},{"className":2466},[],[2468],{"type":49,"value":2469},"postgres()",{"type":49,"value":2471}," factory, a Supabase app builds its client with ",{"type":44,"tag":77,"props":2473,"children":2475},{"className":2474},[],[2476],{"type":49,"value":82},{"type":49,"value":2478}," from the extension's ",{"type":44,"tag":77,"props":2480,"children":2482},{"className":2481},[],[2483],{"type":49,"value":2484},"\u002Fruntime",{"type":49,"value":2486}," subpath. The factory is ",{"type":44,"tag":60,"props":2488,"children":2489},{},[2490],{"type":49,"value":2491},"async",{"type":49,"value":2493}," (it prepares JWT key material — including the one-time JWKS fetch when ",{"type":44,"tag":77,"props":2495,"children":2497},{"className":2496},[],[2498],{"type":49,"value":679},{"type":49,"value":2500}," is set), and the result is role-first.",{"type":44,"tag":1019,"props":2502,"children":2504},{"className":1021,"code":2503,"language":1023,"meta":1024,"style":1024},"\u002F\u002F src\u002Fprisma\u002Fdb.ts\nimport { supabase } from '@prisma-next\u002Fextension-supabase\u002Fruntime';\nimport type { Contract } from '.\u002Fcontract.d';\nimport contractJson from '.\u002Fcontract.json' with { type: 'json' };\n\nexport const db = await supabase\u003CContract>({\n  contractJson,\n  url: process.env['DATABASE_URL'],        \u002F\u002F direct Postgres connection — see pitfalls\n  jwksUrl: process.env['SUPABASE_JWKS_URL'], \u002F\u002F https:\u002F\u002F\u003Cproject-ref>.supabase.co\u002Fauth\u002Fv1\u002F.well-known\u002Fjwks.json\n  \u002F\u002F Legacy HS256 projects use jwtSecret: process.env['SUPABASE_JWT_SECRET'] instead — exactly one of the two.\n});\n",[2505],{"type":44,"tag":77,"props":2506,"children":2507},{"__ignoreMap":1024},[2508,2516,2557,2603,2667,2674,2730,2742,2795,2845,2853],{"type":44,"tag":1030,"props":2509,"children":2510},{"class":1032,"line":1033},[2511],{"type":44,"tag":1030,"props":2512,"children":2513},{"style":1037},[2514],{"type":49,"value":2515},"\u002F\u002F src\u002Fprisma\u002Fdb.ts\n",{"type":44,"tag":1030,"props":2517,"children":2518},{"class":1032,"line":1043},[2519,2523,2527,2532,2536,2540,2544,2549,2553],{"type":44,"tag":1030,"props":2520,"children":2521},{"style":1047},[2522],{"type":49,"value":1050},{"type":44,"tag":1030,"props":2524,"children":2525},{"style":1064},[2526],{"type":49,"value":1096},{"type":44,"tag":1030,"props":2528,"children":2529},{"style":1053},[2530],{"type":49,"value":2531}," supabase",{"type":44,"tag":1030,"props":2533,"children":2534},{"style":1064},[2535],{"type":49,"value":1106},{"type":44,"tag":1030,"props":2537,"children":2538},{"style":1047},[2539],{"type":49,"value":1111},{"type":44,"tag":1030,"props":2541,"children":2542},{"style":1064},[2543],{"type":49,"value":1067},{"type":44,"tag":1030,"props":2545,"children":2546},{"style":1070},[2547],{"type":49,"value":2548},"@prisma-next\u002Fextension-supabase\u002Fruntime",{"type":44,"tag":1030,"props":2550,"children":2551},{"style":1064},[2552],{"type":49,"value":1078},{"type":44,"tag":1030,"props":2554,"children":2555},{"style":1064},[2556],{"type":49,"value":1083},{"type":44,"tag":1030,"props":2558,"children":2559},{"class":1032,"line":1086},[2560,2564,2569,2573,2578,2582,2586,2590,2595,2599],{"type":44,"tag":1030,"props":2561,"children":2562},{"style":1047},[2563],{"type":49,"value":1050},{"type":44,"tag":1030,"props":2565,"children":2566},{"style":1047},[2567],{"type":49,"value":2568}," type",{"type":44,"tag":1030,"props":2570,"children":2571},{"style":1064},[2572],{"type":49,"value":1096},{"type":44,"tag":1030,"props":2574,"children":2575},{"style":1053},[2576],{"type":49,"value":2577}," Contract",{"type":44,"tag":1030,"props":2579,"children":2580},{"style":1064},[2581],{"type":49,"value":1106},{"type":44,"tag":1030,"props":2583,"children":2584},{"style":1047},[2585],{"type":49,"value":1111},{"type":44,"tag":1030,"props":2587,"children":2588},{"style":1064},[2589],{"type":49,"value":1067},{"type":44,"tag":1030,"props":2591,"children":2592},{"style":1070},[2593],{"type":49,"value":2594},".\u002Fcontract.d",{"type":44,"tag":1030,"props":2596,"children":2597},{"style":1064},[2598],{"type":49,"value":1078},{"type":44,"tag":1030,"props":2600,"children":2601},{"style":1064},[2602],{"type":49,"value":1083},{"type":44,"tag":1030,"props":2604,"children":2605},{"class":1032,"line":1131},[2606,2610,2615,2619,2623,2628,2632,2637,2641,2645,2649,2653,2658,2662],{"type":44,"tag":1030,"props":2607,"children":2608},{"style":1047},[2609],{"type":49,"value":1050},{"type":44,"tag":1030,"props":2611,"children":2612},{"style":1053},[2613],{"type":49,"value":2614}," contractJson ",{"type":44,"tag":1030,"props":2616,"children":2617},{"style":1047},[2618],{"type":49,"value":1061},{"type":44,"tag":1030,"props":2620,"children":2621},{"style":1064},[2622],{"type":49,"value":1067},{"type":44,"tag":1030,"props":2624,"children":2625},{"style":1070},[2626],{"type":49,"value":2627},".\u002Fcontract.json",{"type":44,"tag":1030,"props":2629,"children":2630},{"style":1064},[2631],{"type":49,"value":1078},{"type":44,"tag":1030,"props":2633,"children":2634},{"style":1047},[2635],{"type":49,"value":2636}," with",{"type":44,"tag":1030,"props":2638,"children":2639},{"style":1064},[2640],{"type":49,"value":1096},{"type":44,"tag":1030,"props":2642,"children":2643},{"style":1427},[2644],{"type":49,"value":2568},{"type":44,"tag":1030,"props":2646,"children":2647},{"style":1064},[2648],{"type":49,"value":1435},{"type":44,"tag":1030,"props":2650,"children":2651},{"style":1064},[2652],{"type":49,"value":1067},{"type":44,"tag":1030,"props":2654,"children":2655},{"style":1070},[2656],{"type":49,"value":2657},"json",{"type":44,"tag":1030,"props":2659,"children":2660},{"style":1064},[2661],{"type":49,"value":1078},{"type":44,"tag":1030,"props":2663,"children":2664},{"style":1064},[2665],{"type":49,"value":2666}," };\n",{"type":44,"tag":1030,"props":2668,"children":2669},{"class":1032,"line":1165},[2670],{"type":44,"tag":1030,"props":2671,"children":2672},{"emptyLinePlaceholder":1388},[2673],{"type":49,"value":1391},{"type":44,"tag":1030,"props":2675,"children":2676},{"class":1032,"line":1198},[2677,2681,2687,2692,2697,2702,2706,2711,2717,2722,2726],{"type":44,"tag":1030,"props":2678,"children":2679},{"style":1047},[2680],{"type":49,"value":1400},{"type":44,"tag":1030,"props":2682,"children":2684},{"style":2683},"--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA",[2685],{"type":49,"value":2686}," const",{"type":44,"tag":1030,"props":2688,"children":2689},{"style":1053},[2690],{"type":49,"value":2691}," db ",{"type":44,"tag":1030,"props":2693,"children":2694},{"style":1064},[2695],{"type":49,"value":2696},"=",{"type":44,"tag":1030,"props":2698,"children":2699},{"style":1047},[2700],{"type":49,"value":2701}," await",{"type":44,"tag":1030,"props":2703,"children":2704},{"style":1408},[2705],{"type":49,"value":2531},{"type":44,"tag":1030,"props":2707,"children":2708},{"style":1064},[2709],{"type":49,"value":2710},"\u003C",{"type":44,"tag":1030,"props":2712,"children":2714},{"style":2713},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[2715],{"type":49,"value":2716},"Contract",{"type":44,"tag":1030,"props":2718,"children":2719},{"style":1064},[2720],{"type":49,"value":2721},">",{"type":44,"tag":1030,"props":2723,"children":2724},{"style":1053},[2725],{"type":49,"value":1415},{"type":44,"tag":1030,"props":2727,"children":2728},{"style":1064},[2729],{"type":49,"value":1420},{"type":44,"tag":1030,"props":2731,"children":2732},{"class":1032,"line":1232},[2733,2738],{"type":44,"tag":1030,"props":2734,"children":2735},{"style":1053},[2736],{"type":49,"value":2737},"  contractJson",{"type":44,"tag":1030,"props":2739,"children":2740},{"style":1064},[2741],{"type":49,"value":1445},{"type":44,"tag":1030,"props":2743,"children":2744},{"class":1032,"line":1274},[2745,2750,2754,2759,2763,2768,2772,2777,2781,2786,2790],{"type":44,"tag":1030,"props":2746,"children":2747},{"style":1427},[2748],{"type":49,"value":2749},"  url",{"type":44,"tag":1030,"props":2751,"children":2752},{"style":1064},[2753],{"type":49,"value":1435},{"type":44,"tag":1030,"props":2755,"children":2756},{"style":1053},[2757],{"type":49,"value":2758}," process",{"type":44,"tag":1030,"props":2760,"children":2761},{"style":1064},[2762],{"type":49,"value":201},{"type":44,"tag":1030,"props":2764,"children":2765},{"style":1053},[2766],{"type":49,"value":2767},"env[",{"type":44,"tag":1030,"props":2769,"children":2770},{"style":1064},[2771],{"type":49,"value":1078},{"type":44,"tag":1030,"props":2773,"children":2774},{"style":1070},[2775],{"type":49,"value":2776},"DATABASE_URL",{"type":44,"tag":1030,"props":2778,"children":2779},{"style":1064},[2780],{"type":49,"value":1078},{"type":44,"tag":1030,"props":2782,"children":2783},{"style":1053},[2784],{"type":49,"value":2785},"]",{"type":44,"tag":1030,"props":2787,"children":2788},{"style":1064},[2789],{"type":49,"value":1571},{"type":44,"tag":1030,"props":2791,"children":2792},{"style":1037},[2793],{"type":49,"value":2794},"        \u002F\u002F direct Postgres connection — see pitfalls\n",{"type":44,"tag":1030,"props":2796,"children":2797},{"class":1032,"line":1308},[2798,2803,2807,2811,2815,2819,2823,2828,2832,2836,2840],{"type":44,"tag":1030,"props":2799,"children":2800},{"style":1427},[2801],{"type":49,"value":2802},"  jwksUrl",{"type":44,"tag":1030,"props":2804,"children":2805},{"style":1064},[2806],{"type":49,"value":1435},{"type":44,"tag":1030,"props":2808,"children":2809},{"style":1053},[2810],{"type":49,"value":2758},{"type":44,"tag":1030,"props":2812,"children":2813},{"style":1064},[2814],{"type":49,"value":201},{"type":44,"tag":1030,"props":2816,"children":2817},{"style":1053},[2818],{"type":49,"value":2767},{"type":44,"tag":1030,"props":2820,"children":2821},{"style":1064},[2822],{"type":49,"value":1078},{"type":44,"tag":1030,"props":2824,"children":2825},{"style":1070},[2826],{"type":49,"value":2827},"SUPABASE_JWKS_URL",{"type":44,"tag":1030,"props":2829,"children":2830},{"style":1064},[2831],{"type":49,"value":1078},{"type":44,"tag":1030,"props":2833,"children":2834},{"style":1053},[2835],{"type":49,"value":2785},{"type":44,"tag":1030,"props":2837,"children":2838},{"style":1064},[2839],{"type":49,"value":1571},{"type":44,"tag":1030,"props":2841,"children":2842},{"style":1037},[2843],{"type":49,"value":2844}," \u002F\u002F https:\u002F\u002F\u003Cproject-ref>.supabase.co\u002Fauth\u002Fv1\u002F.well-known\u002Fjwks.json\n",{"type":44,"tag":1030,"props":2846,"children":2847},{"class":1032,"line":1342},[2848],{"type":44,"tag":1030,"props":2849,"children":2850},{"style":1037},[2851],{"type":49,"value":2852},"  \u002F\u002F Legacy HS256 projects use jwtSecret: process.env['SUPABASE_JWT_SECRET'] instead — exactly one of the two.\n",{"type":44,"tag":1030,"props":2854,"children":2855},{"class":1032,"line":1384},[2856,2860,2864],{"type":44,"tag":1030,"props":2857,"children":2858},{"style":1064},[2859],{"type":49,"value":1720},{"type":44,"tag":1030,"props":2861,"children":2862},{"style":1053},[2863],{"type":49,"value":1663},{"type":44,"tag":1030,"props":2865,"children":2866},{"style":1064},[2867],{"type":49,"value":1083},{"type":44,"tag":56,"props":2869,"children":2870},{},[2871,2873,2879,2881,2886,2888,2893,2895,2901,2903,2909,2910,2916,2918,2924,2925,2931,2933,2939,2941,2947,2948,2954,2956,2961],{"type":49,"value":2872},"Options beyond the basics: ",{"type":44,"tag":77,"props":2874,"children":2876},{"className":2875},[],[2877],{"type":49,"value":2878},"middleware",{"type":49,"value":2880}," (same composition as ",{"type":44,"tag":77,"props":2882,"children":2884},{"className":2883},[],[2885],{"type":49,"value":2469},{"type":49,"value":2887}," — see ",{"type":44,"tag":77,"props":2889,"children":2891},{"className":2890},[],[2892],{"type":49,"value":241},{"type":49,"value":2894},"; middleware never sees the role-binding ",{"type":44,"tag":77,"props":2896,"children":2898},{"className":2897},[],[2899],{"type":49,"value":2900},"set_config",{"type":49,"value":2902}," calls), ",{"type":44,"tag":77,"props":2904,"children":2906},{"className":2905},[],[2907],{"type":49,"value":2908},"poolOptions",{"type":49,"value":114},{"type":44,"tag":77,"props":2911,"children":2913},{"className":2912},[],[2914],{"type":49,"value":2915},"pg",{"type":49,"value":2917}," (BYO ",{"type":44,"tag":77,"props":2919,"children":2921},{"className":2920},[],[2922],{"type":49,"value":2923},"pg.Pool",{"type":49,"value":456},{"type":44,"tag":77,"props":2926,"children":2928},{"className":2927},[],[2929],{"type":49,"value":2930},"pg.Client",{"type":49,"value":2932}," instead of ",{"type":44,"tag":77,"props":2934,"children":2936},{"className":2935},[],[2937],{"type":49,"value":2938},"url",{"type":49,"value":2940},"). Teardown is ",{"type":44,"tag":77,"props":2942,"children":2944},{"className":2943},[],[2945],{"type":49,"value":2946},"await db.close()",{"type":49,"value":456},{"type":44,"tag":77,"props":2949,"children":2951},{"className":2950},[],[2952],{"type":49,"value":2953},"await using",{"type":49,"value":2955}," exactly as in ",{"type":44,"tag":77,"props":2957,"children":2959},{"className":2958},[],[2960],{"type":49,"value":241},{"type":49,"value":2962}," — the same script-hang rules apply.",{"type":44,"tag":86,"props":2964,"children":2966},{"id":2965},"workflow-role-bound-queries",[2967],{"type":49,"value":2968},"Workflow — Role-bound queries",{"type":44,"tag":56,"props":2970,"children":2971},{},[2972,2974,2979,2981,2986],{"type":49,"value":2973},"The concept: bind the role that should execute the request, then query through the returned ",{"type":44,"tag":77,"props":2975,"children":2977},{"className":2976},[],[2978],{"type":49,"value":492},{"type":49,"value":2980}," — every query surface from ",{"type":44,"tag":77,"props":2982,"children":2984},{"className":2983},[],[2985],{"type":49,"value":253},{"type":49,"value":2987}," works, RLS-filtered by Postgres.",{"type":44,"tag":1019,"props":2989,"children":2991},{"className":1021,"code":2990,"language":1023,"meta":1024,"style":1024},"\u002F\u002F A signed-in user: rows are RLS-scoped to the JWT's auth.uid().\nconst userDb = await db.asUser(jwt); \u002F\u002F async — rejects with code SUPABASE.JWT_INVALID on a bad\u002Fexpired token\nconst mine = await userDb.orm.public.Profile.select('id', 'username').all();\n\n\u002F\u002F The anon role: sees what anon policies permit.\nconst listing = await db.asAnon().orm.public.Profile.select('id', 'username').all();\n\n\u002F\u002F service_role: BYPASSRLS — sees everything in YOUR contract.\nconst all = await db.asServiceRole().orm.public.Profile.select('id', 'username').all();\n\n\u002F\u002F Writes ride the same surfaces; RLS filters them too. An UPDATE against\n\u002F\u002F another owner's row affects 0 rows; a withCheck violation raises an error.\nconst updated = await userDb.orm.public.Profile\n  .where({ userId: me })\n  .updateAndCount({ username: 'new-name' });\n",[2992],{"type":44,"tag":77,"props":2993,"children":2994},{"__ignoreMap":1024},[2995,3003,3052,3167,3174,3182,3302,3309,3317,3438,3445,3453,3461,3510,3555],{"type":44,"tag":1030,"props":2996,"children":2997},{"class":1032,"line":1033},[2998],{"type":44,"tag":1030,"props":2999,"children":3000},{"style":1037},[3001],{"type":49,"value":3002},"\u002F\u002F A signed-in user: rows are RLS-scoped to the JWT's auth.uid().\n",{"type":44,"tag":1030,"props":3004,"children":3005},{"class":1032,"line":1043},[3006,3011,3016,3020,3024,3029,3033,3037,3042,3047],{"type":44,"tag":1030,"props":3007,"children":3008},{"style":2683},[3009],{"type":49,"value":3010},"const",{"type":44,"tag":1030,"props":3012,"children":3013},{"style":1053},[3014],{"type":49,"value":3015}," userDb ",{"type":44,"tag":1030,"props":3017,"children":3018},{"style":1064},[3019],{"type":49,"value":2696},{"type":44,"tag":1030,"props":3021,"children":3022},{"style":1047},[3023],{"type":49,"value":2701},{"type":44,"tag":1030,"props":3025,"children":3026},{"style":1053},[3027],{"type":49,"value":3028}," db",{"type":44,"tag":1030,"props":3030,"children":3031},{"style":1064},[3032],{"type":49,"value":201},{"type":44,"tag":1030,"props":3034,"children":3035},{"style":1408},[3036],{"type":49,"value":925},{"type":44,"tag":1030,"props":3038,"children":3039},{"style":1053},[3040],{"type":49,"value":3041},"(jwt)",{"type":44,"tag":1030,"props":3043,"children":3044},{"style":1064},[3045],{"type":49,"value":3046},";",{"type":44,"tag":1030,"props":3048,"children":3049},{"style":1037},[3050],{"type":49,"value":3051}," \u002F\u002F async — rejects with code SUPABASE.JWT_INVALID on a bad\u002Fexpired token\n",{"type":44,"tag":1030,"props":3053,"children":3054},{"class":1032,"line":1086},[3055,3059,3064,3068,3072,3077,3081,3085,3089,3093,3097,3102,3106,3111,3115,3119,3124,3128,3132,3136,3141,3145,3149,3153,3158,3163],{"type":44,"tag":1030,"props":3056,"children":3057},{"style":2683},[3058],{"type":49,"value":3010},{"type":44,"tag":1030,"props":3060,"children":3061},{"style":1053},[3062],{"type":49,"value":3063}," mine ",{"type":44,"tag":1030,"props":3065,"children":3066},{"style":1064},[3067],{"type":49,"value":2696},{"type":44,"tag":1030,"props":3069,"children":3070},{"style":1047},[3071],{"type":49,"value":2701},{"type":44,"tag":1030,"props":3073,"children":3074},{"style":1053},[3075],{"type":49,"value":3076}," userDb",{"type":44,"tag":1030,"props":3078,"children":3079},{"style":1064},[3080],{"type":49,"value":201},{"type":44,"tag":1030,"props":3082,"children":3083},{"style":1053},[3084],{"type":49,"value":21},{"type":44,"tag":1030,"props":3086,"children":3087},{"style":1064},[3088],{"type":49,"value":201},{"type":44,"tag":1030,"props":3090,"children":3091},{"style":1053},[3092],{"type":49,"value":637},{"type":44,"tag":1030,"props":3094,"children":3095},{"style":1064},[3096],{"type":49,"value":201},{"type":44,"tag":1030,"props":3098,"children":3099},{"style":1053},[3100],{"type":49,"value":3101},"Profile",{"type":44,"tag":1030,"props":3103,"children":3104},{"style":1064},[3105],{"type":49,"value":201},{"type":44,"tag":1030,"props":3107,"children":3108},{"style":1408},[3109],{"type":49,"value":3110},"select",{"type":44,"tag":1030,"props":3112,"children":3113},{"style":1053},[3114],{"type":49,"value":1415},{"type":44,"tag":1030,"props":3116,"children":3117},{"style":1064},[3118],{"type":49,"value":1078},{"type":44,"tag":1030,"props":3120,"children":3121},{"style":1070},[3122],{"type":49,"value":3123},"id",{"type":44,"tag":1030,"props":3125,"children":3126},{"style":1064},[3127],{"type":49,"value":1078},{"type":44,"tag":1030,"props":3129,"children":3130},{"style":1064},[3131],{"type":49,"value":1571},{"type":44,"tag":1030,"props":3133,"children":3134},{"style":1064},[3135],{"type":49,"value":1067},{"type":44,"tag":1030,"props":3137,"children":3138},{"style":1070},[3139],{"type":49,"value":3140},"username",{"type":44,"tag":1030,"props":3142,"children":3143},{"style":1064},[3144],{"type":49,"value":1078},{"type":44,"tag":1030,"props":3146,"children":3147},{"style":1053},[3148],{"type":49,"value":1663},{"type":44,"tag":1030,"props":3150,"children":3151},{"style":1064},[3152],{"type":49,"value":201},{"type":44,"tag":1030,"props":3154,"children":3155},{"style":1408},[3156],{"type":49,"value":3157},"all",{"type":44,"tag":1030,"props":3159,"children":3160},{"style":1053},[3161],{"type":49,"value":3162},"()",{"type":44,"tag":1030,"props":3164,"children":3165},{"style":1064},[3166],{"type":49,"value":1083},{"type":44,"tag":1030,"props":3168,"children":3169},{"class":1032,"line":1131},[3170],{"type":44,"tag":1030,"props":3171,"children":3172},{"emptyLinePlaceholder":1388},[3173],{"type":49,"value":1391},{"type":44,"tag":1030,"props":3175,"children":3176},{"class":1032,"line":1165},[3177],{"type":44,"tag":1030,"props":3178,"children":3179},{"style":1037},[3180],{"type":49,"value":3181},"\u002F\u002F The anon role: sees what anon policies permit.\n",{"type":44,"tag":1030,"props":3183,"children":3184},{"class":1032,"line":1198},[3185,3189,3194,3198,3202,3206,3210,3214,3218,3222,3226,3230,3234,3238,3242,3246,3250,3254,3258,3262,3266,3270,3274,3278,3282,3286,3290,3294,3298],{"type":44,"tag":1030,"props":3186,"children":3187},{"style":2683},[3188],{"type":49,"value":3010},{"type":44,"tag":1030,"props":3190,"children":3191},{"style":1053},[3192],{"type":49,"value":3193}," listing ",{"type":44,"tag":1030,"props":3195,"children":3196},{"style":1064},[3197],{"type":49,"value":2696},{"type":44,"tag":1030,"props":3199,"children":3200},{"style":1047},[3201],{"type":49,"value":2701},{"type":44,"tag":1030,"props":3203,"children":3204},{"style":1053},[3205],{"type":49,"value":3028},{"type":44,"tag":1030,"props":3207,"children":3208},{"style":1064},[3209],{"type":49,"value":201},{"type":44,"tag":1030,"props":3211,"children":3212},{"style":1408},[3213],{"type":49,"value":932},{"type":44,"tag":1030,"props":3215,"children":3216},{"style":1053},[3217],{"type":49,"value":3162},{"type":44,"tag":1030,"props":3219,"children":3220},{"style":1064},[3221],{"type":49,"value":201},{"type":44,"tag":1030,"props":3223,"children":3224},{"style":1053},[3225],{"type":49,"value":21},{"type":44,"tag":1030,"props":3227,"children":3228},{"style":1064},[3229],{"type":49,"value":201},{"type":44,"tag":1030,"props":3231,"children":3232},{"style":1053},[3233],{"type":49,"value":637},{"type":44,"tag":1030,"props":3235,"children":3236},{"style":1064},[3237],{"type":49,"value":201},{"type":44,"tag":1030,"props":3239,"children":3240},{"style":1053},[3241],{"type":49,"value":3101},{"type":44,"tag":1030,"props":3243,"children":3244},{"style":1064},[3245],{"type":49,"value":201},{"type":44,"tag":1030,"props":3247,"children":3248},{"style":1408},[3249],{"type":49,"value":3110},{"type":44,"tag":1030,"props":3251,"children":3252},{"style":1053},[3253],{"type":49,"value":1415},{"type":44,"tag":1030,"props":3255,"children":3256},{"style":1064},[3257],{"type":49,"value":1078},{"type":44,"tag":1030,"props":3259,"children":3260},{"style":1070},[3261],{"type":49,"value":3123},{"type":44,"tag":1030,"props":3263,"children":3264},{"style":1064},[3265],{"type":49,"value":1078},{"type":44,"tag":1030,"props":3267,"children":3268},{"style":1064},[3269],{"type":49,"value":1571},{"type":44,"tag":1030,"props":3271,"children":3272},{"style":1064},[3273],{"type":49,"value":1067},{"type":44,"tag":1030,"props":3275,"children":3276},{"style":1070},[3277],{"type":49,"value":3140},{"type":44,"tag":1030,"props":3279,"children":3280},{"style":1064},[3281],{"type":49,"value":1078},{"type":44,"tag":1030,"props":3283,"children":3284},{"style":1053},[3285],{"type":49,"value":1663},{"type":44,"tag":1030,"props":3287,"children":3288},{"style":1064},[3289],{"type":49,"value":201},{"type":44,"tag":1030,"props":3291,"children":3292},{"style":1408},[3293],{"type":49,"value":3157},{"type":44,"tag":1030,"props":3295,"children":3296},{"style":1053},[3297],{"type":49,"value":3162},{"type":44,"tag":1030,"props":3299,"children":3300},{"style":1064},[3301],{"type":49,"value":1083},{"type":44,"tag":1030,"props":3303,"children":3304},{"class":1032,"line":1232},[3305],{"type":44,"tag":1030,"props":3306,"children":3307},{"emptyLinePlaceholder":1388},[3308],{"type":49,"value":1391},{"type":44,"tag":1030,"props":3310,"children":3311},{"class":1032,"line":1274},[3312],{"type":44,"tag":1030,"props":3313,"children":3314},{"style":1037},[3315],{"type":49,"value":3316},"\u002F\u002F service_role: BYPASSRLS — sees everything in YOUR contract.\n",{"type":44,"tag":1030,"props":3318,"children":3319},{"class":1032,"line":1308},[3320,3324,3329,3333,3337,3341,3345,3350,3354,3358,3362,3366,3370,3374,3378,3382,3386,3390,3394,3398,3402,3406,3410,3414,3418,3422,3426,3430,3434],{"type":44,"tag":1030,"props":3321,"children":3322},{"style":2683},[3323],{"type":49,"value":3010},{"type":44,"tag":1030,"props":3325,"children":3326},{"style":1053},[3327],{"type":49,"value":3328}," all ",{"type":44,"tag":1030,"props":3330,"children":3331},{"style":1064},[3332],{"type":49,"value":2696},{"type":44,"tag":1030,"props":3334,"children":3335},{"style":1047},[3336],{"type":49,"value":2701},{"type":44,"tag":1030,"props":3338,"children":3339},{"style":1053},[3340],{"type":49,"value":3028},{"type":44,"tag":1030,"props":3342,"children":3343},{"style":1064},[3344],{"type":49,"value":201},{"type":44,"tag":1030,"props":3346,"children":3347},{"style":1408},[3348],{"type":49,"value":3349},"asServiceRole",{"type":44,"tag":1030,"props":3351,"children":3352},{"style":1053},[3353],{"type":49,"value":3162},{"type":44,"tag":1030,"props":3355,"children":3356},{"style":1064},[3357],{"type":49,"value":201},{"type":44,"tag":1030,"props":3359,"children":3360},{"style":1053},[3361],{"type":49,"value":21},{"type":44,"tag":1030,"props":3363,"children":3364},{"style":1064},[3365],{"type":49,"value":201},{"type":44,"tag":1030,"props":3367,"children":3368},{"style":1053},[3369],{"type":49,"value":637},{"type":44,"tag":1030,"props":3371,"children":3372},{"style":1064},[3373],{"type":49,"value":201},{"type":44,"tag":1030,"props":3375,"children":3376},{"style":1053},[3377],{"type":49,"value":3101},{"type":44,"tag":1030,"props":3379,"children":3380},{"style":1064},[3381],{"type":49,"value":201},{"type":44,"tag":1030,"props":3383,"children":3384},{"style":1408},[3385],{"type":49,"value":3110},{"type":44,"tag":1030,"props":3387,"children":3388},{"style":1053},[3389],{"type":49,"value":1415},{"type":44,"tag":1030,"props":3391,"children":3392},{"style":1064},[3393],{"type":49,"value":1078},{"type":44,"tag":1030,"props":3395,"children":3396},{"style":1070},[3397],{"type":49,"value":3123},{"type":44,"tag":1030,"props":3399,"children":3400},{"style":1064},[3401],{"type":49,"value":1078},{"type":44,"tag":1030,"props":3403,"children":3404},{"style":1064},[3405],{"type":49,"value":1571},{"type":44,"tag":1030,"props":3407,"children":3408},{"style":1064},[3409],{"type":49,"value":1067},{"type":44,"tag":1030,"props":3411,"children":3412},{"style":1070},[3413],{"type":49,"value":3140},{"type":44,"tag":1030,"props":3415,"children":3416},{"style":1064},[3417],{"type":49,"value":1078},{"type":44,"tag":1030,"props":3419,"children":3420},{"style":1053},[3421],{"type":49,"value":1663},{"type":44,"tag":1030,"props":3423,"children":3424},{"style":1064},[3425],{"type":49,"value":201},{"type":44,"tag":1030,"props":3427,"children":3428},{"style":1408},[3429],{"type":49,"value":3157},{"type":44,"tag":1030,"props":3431,"children":3432},{"style":1053},[3433],{"type":49,"value":3162},{"type":44,"tag":1030,"props":3435,"children":3436},{"style":1064},[3437],{"type":49,"value":1083},{"type":44,"tag":1030,"props":3439,"children":3440},{"class":1032,"line":1342},[3441],{"type":44,"tag":1030,"props":3442,"children":3443},{"emptyLinePlaceholder":1388},[3444],{"type":49,"value":1391},{"type":44,"tag":1030,"props":3446,"children":3447},{"class":1032,"line":1384},[3448],{"type":44,"tag":1030,"props":3449,"children":3450},{"style":1037},[3451],{"type":49,"value":3452},"\u002F\u002F Writes ride the same surfaces; RLS filters them too. An UPDATE against\n",{"type":44,"tag":1030,"props":3454,"children":3455},{"class":1032,"line":1394},[3456],{"type":44,"tag":1030,"props":3457,"children":3458},{"style":1037},[3459],{"type":49,"value":3460},"\u002F\u002F another owner's row affects 0 rows; a withCheck violation raises an error.\n",{"type":44,"tag":1030,"props":3462,"children":3463},{"class":1032,"line":1423},[3464,3468,3473,3477,3481,3485,3489,3493,3497,3501,3505],{"type":44,"tag":1030,"props":3465,"children":3466},{"style":2683},[3467],{"type":49,"value":3010},{"type":44,"tag":1030,"props":3469,"children":3470},{"style":1053},[3471],{"type":49,"value":3472}," updated ",{"type":44,"tag":1030,"props":3474,"children":3475},{"style":1064},[3476],{"type":49,"value":2696},{"type":44,"tag":1030,"props":3478,"children":3479},{"style":1047},[3480],{"type":49,"value":2701},{"type":44,"tag":1030,"props":3482,"children":3483},{"style":1053},[3484],{"type":49,"value":3076},{"type":44,"tag":1030,"props":3486,"children":3487},{"style":1064},[3488],{"type":49,"value":201},{"type":44,"tag":1030,"props":3490,"children":3491},{"style":1053},[3492],{"type":49,"value":21},{"type":44,"tag":1030,"props":3494,"children":3495},{"style":1064},[3496],{"type":49,"value":201},{"type":44,"tag":1030,"props":3498,"children":3499},{"style":1053},[3500],{"type":49,"value":637},{"type":44,"tag":1030,"props":3502,"children":3503},{"style":1064},[3504],{"type":49,"value":201},{"type":44,"tag":1030,"props":3506,"children":3507},{"style":1053},[3508],{"type":49,"value":3509},"Profile\n",{"type":44,"tag":1030,"props":3511,"children":3512},{"class":1032,"line":1448},[3513,3518,3523,3527,3532,3537,3541,3546,3550],{"type":44,"tag":1030,"props":3514,"children":3515},{"style":1064},[3516],{"type":49,"value":3517},"  .",{"type":44,"tag":1030,"props":3519,"children":3520},{"style":1408},[3521],{"type":49,"value":3522},"where",{"type":44,"tag":1030,"props":3524,"children":3525},{"style":1053},[3526],{"type":49,"value":1415},{"type":44,"tag":1030,"props":3528,"children":3529},{"style":1064},[3530],{"type":49,"value":3531},"{",{"type":44,"tag":1030,"props":3533,"children":3534},{"style":1427},[3535],{"type":49,"value":3536}," userId",{"type":44,"tag":1030,"props":3538,"children":3539},{"style":1064},[3540],{"type":49,"value":1435},{"type":44,"tag":1030,"props":3542,"children":3543},{"style":1053},[3544],{"type":49,"value":3545}," me ",{"type":44,"tag":1030,"props":3547,"children":3548},{"style":1064},[3549],{"type":49,"value":1720},{"type":44,"tag":1030,"props":3551,"children":3552},{"style":1053},[3553],{"type":49,"value":3554},")\n",{"type":44,"tag":1030,"props":3556,"children":3557},{"class":1032,"line":30},[3558,3562,3567,3571,3575,3580,3584,3588,3593,3597,3601,3605],{"type":44,"tag":1030,"props":3559,"children":3560},{"style":1064},[3561],{"type":49,"value":3517},{"type":44,"tag":1030,"props":3563,"children":3564},{"style":1408},[3565],{"type":49,"value":3566},"updateAndCount",{"type":44,"tag":1030,"props":3568,"children":3569},{"style":1053},[3570],{"type":49,"value":1415},{"type":44,"tag":1030,"props":3572,"children":3573},{"style":1064},[3574],{"type":49,"value":3531},{"type":44,"tag":1030,"props":3576,"children":3577},{"style":1427},[3578],{"type":49,"value":3579}," username",{"type":44,"tag":1030,"props":3581,"children":3582},{"style":1064},[3583],{"type":49,"value":1435},{"type":44,"tag":1030,"props":3585,"children":3586},{"style":1064},[3587],{"type":49,"value":1067},{"type":44,"tag":1030,"props":3589,"children":3590},{"style":1070},[3591],{"type":49,"value":3592},"new-name",{"type":44,"tag":1030,"props":3594,"children":3595},{"style":1064},[3596],{"type":49,"value":1078},{"type":44,"tag":1030,"props":3598,"children":3599},{"style":1064},[3600],{"type":49,"value":1106},{"type":44,"tag":1030,"props":3602,"children":3603},{"style":1053},[3604],{"type":49,"value":1663},{"type":44,"tag":1030,"props":3606,"children":3607},{"style":1064},[3608],{"type":49,"value":1083},{"type":44,"tag":56,"props":3610,"children":3611},{},[3612,3614,3619,3620,3625,3627,3632,3634,3640,3641,3647,3649,3654,3656,3661,3663,3669],{"type":49,"value":3613},"Notes: ",{"type":44,"tag":77,"props":3615,"children":3617},{"className":3616},[],[3618],{"type":49,"value":147},{"type":49,"value":456},{"type":44,"tag":77,"props":3621,"children":3623},{"className":3622},[],[3624],{"type":49,"value":154},{"type":49,"value":3626}," are sync; only ",{"type":44,"tag":77,"props":3628,"children":3630},{"className":3629},[],[3631],{"type":49,"value":925},{"type":49,"value":3633}," is async. Multi-namespace contracts address models by coordinate (",{"type":44,"tag":77,"props":3635,"children":3637},{"className":3636},[],[3638],{"type":49,"value":3639},"orm.public.Profile",{"type":49,"value":114},{"type":44,"tag":77,"props":3642,"children":3644},{"className":3643},[],[3645],{"type":49,"value":3646},"sql.public.profile",{"type":49,"value":3648},") — see ",{"type":44,"tag":77,"props":3650,"children":3652},{"className":3651},[],[3653],{"type":49,"value":253},{"type":49,"value":3655}," § ",{"type":44,"tag":195,"props":3657,"children":3658},{},[3659],{"type":49,"value":3660},"Namespace-aware accessors",{"type":49,"value":3662},". ",{"type":44,"tag":77,"props":3664,"children":3666},{"className":3665},[],[3667],{"type":49,"value":3668},"RoleBoundDb.transaction(fn)",{"type":49,"value":3670}," wraps work in a transaction on the role-bound session.",{"type":44,"tag":86,"props":3672,"children":3674},{"id":3673},"workflow-admin-reads-of-auth-storage",[3675,3677,3682,3683],{"type":49,"value":3676},"Workflow — Admin reads of ",{"type":44,"tag":77,"props":3678,"children":3680},{"className":3679},[],[3681],{"type":49,"value":179},{"type":49,"value":456},{"type":44,"tag":77,"props":3684,"children":3686},{"className":3685},[],[3687],{"type":49,"value":186},{"type":44,"tag":56,"props":3689,"children":3690},{},[3691,3693,3698,3700,3705,3707,3712,3714,3719],{"type":49,"value":3692},"The concept: Supabase-internal tables are not part of your contract, so they are not on your query surfaces. The ",{"type":44,"tag":77,"props":3694,"children":3696},{"className":3695},[],[3697],{"type":49,"value":345},{"type":49,"value":3699}," binding carries a ",{"type":44,"tag":60,"props":3701,"children":3702},{},[3703],{"type":49,"value":3704},"secondary root",{"type":49,"value":3706}," — ",{"type":44,"tag":77,"props":3708,"children":3710},{"className":3709},[],[3711],{"type":49,"value":835},{"type":49,"value":3713}," — which is the ",{"type":44,"tag":195,"props":3715,"children":3716},{},[3717],{"type":49,"value":3718},"pack's",{"type":49,"value":3720}," contract surface:",{"type":44,"tag":1019,"props":3722,"children":3724},{"className":1021,"code":3723,"language":1023,"meta":1024,"style":1024},"const admin = db.asServiceRole();\n\n\u002F\u002F SQL builder over the pack contract:\nconst users = await admin.supabase\n  .execute(admin.supabase.sql.auth.users.select('id', 'email').build())\n  .toArray();\n\n\u002F\u002F ORM over the pack contract:\nconst sessions = await admin.supabase.orm.auth.AuthSession.select('id', 'aal').all();\n\n\u002F\u002F Native enum values (e.g. auth.aal_level) come typed:\ntype AalLevel = (typeof admin.supabase.nativeEnums.auth.AalLevel)['Value'];\n",[3725],{"type":44,"tag":77,"props":3726,"children":3727},{"__ignoreMap":1024},[3728,3764,3771,3779,3813,3923,3943,3950,3958,4076,4083,4091],{"type":44,"tag":1030,"props":3729,"children":3730},{"class":1032,"line":1033},[3731,3735,3740,3744,3748,3752,3756,3760],{"type":44,"tag":1030,"props":3732,"children":3733},{"style":2683},[3734],{"type":49,"value":3010},{"type":44,"tag":1030,"props":3736,"children":3737},{"style":1053},[3738],{"type":49,"value":3739}," admin ",{"type":44,"tag":1030,"props":3741,"children":3742},{"style":1064},[3743],{"type":49,"value":2696},{"type":44,"tag":1030,"props":3745,"children":3746},{"style":1053},[3747],{"type":49,"value":3028},{"type":44,"tag":1030,"props":3749,"children":3750},{"style":1064},[3751],{"type":49,"value":201},{"type":44,"tag":1030,"props":3753,"children":3754},{"style":1408},[3755],{"type":49,"value":3349},{"type":44,"tag":1030,"props":3757,"children":3758},{"style":1053},[3759],{"type":49,"value":3162},{"type":44,"tag":1030,"props":3761,"children":3762},{"style":1064},[3763],{"type":49,"value":1083},{"type":44,"tag":1030,"props":3765,"children":3766},{"class":1032,"line":1043},[3767],{"type":44,"tag":1030,"props":3768,"children":3769},{"emptyLinePlaceholder":1388},[3770],{"type":49,"value":1391},{"type":44,"tag":1030,"props":3772,"children":3773},{"class":1032,"line":1086},[3774],{"type":44,"tag":1030,"props":3775,"children":3776},{"style":1037},[3777],{"type":49,"value":3778},"\u002F\u002F SQL builder over the pack contract:\n",{"type":44,"tag":1030,"props":3780,"children":3781},{"class":1032,"line":1131},[3782,3786,3791,3795,3799,3804,3808],{"type":44,"tag":1030,"props":3783,"children":3784},{"style":2683},[3785],{"type":49,"value":3010},{"type":44,"tag":1030,"props":3787,"children":3788},{"style":1053},[3789],{"type":49,"value":3790}," users ",{"type":44,"tag":1030,"props":3792,"children":3793},{"style":1064},[3794],{"type":49,"value":2696},{"type":44,"tag":1030,"props":3796,"children":3797},{"style":1047},[3798],{"type":49,"value":2701},{"type":44,"tag":1030,"props":3800,"children":3801},{"style":1053},[3802],{"type":49,"value":3803}," admin",{"type":44,"tag":1030,"props":3805,"children":3806},{"style":1064},[3807],{"type":49,"value":201},{"type":44,"tag":1030,"props":3809,"children":3810},{"style":1053},[3811],{"type":49,"value":3812},"supabase\n",{"type":44,"tag":1030,"props":3814,"children":3815},{"class":1032,"line":1165},[3816,3820,3825,3830,3834,3838,3842,3847,3851,3855,3859,3864,3868,3872,3876,3880,3884,3888,3892,3896,3901,3905,3909,3913,3918],{"type":44,"tag":1030,"props":3817,"children":3818},{"style":1064},[3819],{"type":49,"value":3517},{"type":44,"tag":1030,"props":3821,"children":3822},{"style":1408},[3823],{"type":49,"value":3824},"execute",{"type":44,"tag":1030,"props":3826,"children":3827},{"style":1053},[3828],{"type":49,"value":3829},"(admin",{"type":44,"tag":1030,"props":3831,"children":3832},{"style":1064},[3833],{"type":49,"value":201},{"type":44,"tag":1030,"props":3835,"children":3836},{"style":1053},[3837],{"type":49,"value":18},{"type":44,"tag":1030,"props":3839,"children":3840},{"style":1064},[3841],{"type":49,"value":201},{"type":44,"tag":1030,"props":3843,"children":3844},{"style":1053},[3845],{"type":49,"value":3846},"sql",{"type":44,"tag":1030,"props":3848,"children":3849},{"style":1064},[3850],{"type":49,"value":201},{"type":44,"tag":1030,"props":3852,"children":3853},{"style":1053},[3854],{"type":49,"value":14},{"type":44,"tag":1030,"props":3856,"children":3857},{"style":1064},[3858],{"type":49,"value":201},{"type":44,"tag":1030,"props":3860,"children":3861},{"style":1053},[3862],{"type":49,"value":3863},"users",{"type":44,"tag":1030,"props":3865,"children":3866},{"style":1064},[3867],{"type":49,"value":201},{"type":44,"tag":1030,"props":3869,"children":3870},{"style":1408},[3871],{"type":49,"value":3110},{"type":44,"tag":1030,"props":3873,"children":3874},{"style":1053},[3875],{"type":49,"value":1415},{"type":44,"tag":1030,"props":3877,"children":3878},{"style":1064},[3879],{"type":49,"value":1078},{"type":44,"tag":1030,"props":3881,"children":3882},{"style":1070},[3883],{"type":49,"value":3123},{"type":44,"tag":1030,"props":3885,"children":3886},{"style":1064},[3887],{"type":49,"value":1078},{"type":44,"tag":1030,"props":3889,"children":3890},{"style":1064},[3891],{"type":49,"value":1571},{"type":44,"tag":1030,"props":3893,"children":3894},{"style":1064},[3895],{"type":49,"value":1067},{"type":44,"tag":1030,"props":3897,"children":3898},{"style":1070},[3899],{"type":49,"value":3900},"email",{"type":44,"tag":1030,"props":3902,"children":3903},{"style":1064},[3904],{"type":49,"value":1078},{"type":44,"tag":1030,"props":3906,"children":3907},{"style":1053},[3908],{"type":49,"value":1663},{"type":44,"tag":1030,"props":3910,"children":3911},{"style":1064},[3912],{"type":49,"value":201},{"type":44,"tag":1030,"props":3914,"children":3915},{"style":1408},[3916],{"type":49,"value":3917},"build",{"type":44,"tag":1030,"props":3919,"children":3920},{"style":1053},[3921],{"type":49,"value":3922},"())\n",{"type":44,"tag":1030,"props":3924,"children":3925},{"class":1032,"line":1198},[3926,3930,3935,3939],{"type":44,"tag":1030,"props":3927,"children":3928},{"style":1064},[3929],{"type":49,"value":3517},{"type":44,"tag":1030,"props":3931,"children":3932},{"style":1408},[3933],{"type":49,"value":3934},"toArray",{"type":44,"tag":1030,"props":3936,"children":3937},{"style":1053},[3938],{"type":49,"value":3162},{"type":44,"tag":1030,"props":3940,"children":3941},{"style":1064},[3942],{"type":49,"value":1083},{"type":44,"tag":1030,"props":3944,"children":3945},{"class":1032,"line":1232},[3946],{"type":44,"tag":1030,"props":3947,"children":3948},{"emptyLinePlaceholder":1388},[3949],{"type":49,"value":1391},{"type":44,"tag":1030,"props":3951,"children":3952},{"class":1032,"line":1274},[3953],{"type":44,"tag":1030,"props":3954,"children":3955},{"style":1037},[3956],{"type":49,"value":3957},"\u002F\u002F ORM over the pack contract:\n",{"type":44,"tag":1030,"props":3959,"children":3960},{"class":1032,"line":1308},[3961,3965,3970,3974,3978,3982,3986,3990,3994,3998,4002,4006,4010,4015,4019,4023,4027,4031,4035,4039,4043,4047,4052,4056,4060,4064,4068,4072],{"type":44,"tag":1030,"props":3962,"children":3963},{"style":2683},[3964],{"type":49,"value":3010},{"type":44,"tag":1030,"props":3966,"children":3967},{"style":1053},[3968],{"type":49,"value":3969}," sessions ",{"type":44,"tag":1030,"props":3971,"children":3972},{"style":1064},[3973],{"type":49,"value":2696},{"type":44,"tag":1030,"props":3975,"children":3976},{"style":1047},[3977],{"type":49,"value":2701},{"type":44,"tag":1030,"props":3979,"children":3980},{"style":1053},[3981],{"type":49,"value":3803},{"type":44,"tag":1030,"props":3983,"children":3984},{"style":1064},[3985],{"type":49,"value":201},{"type":44,"tag":1030,"props":3987,"children":3988},{"style":1053},[3989],{"type":49,"value":18},{"type":44,"tag":1030,"props":3991,"children":3992},{"style":1064},[3993],{"type":49,"value":201},{"type":44,"tag":1030,"props":3995,"children":3996},{"style":1053},[3997],{"type":49,"value":21},{"type":44,"tag":1030,"props":3999,"children":4000},{"style":1064},[4001],{"type":49,"value":201},{"type":44,"tag":1030,"props":4003,"children":4004},{"style":1053},[4005],{"type":49,"value":14},{"type":44,"tag":1030,"props":4007,"children":4008},{"style":1064},[4009],{"type":49,"value":201},{"type":44,"tag":1030,"props":4011,"children":4012},{"style":1053},[4013],{"type":49,"value":4014},"AuthSession",{"type":44,"tag":1030,"props":4016,"children":4017},{"style":1064},[4018],{"type":49,"value":201},{"type":44,"tag":1030,"props":4020,"children":4021},{"style":1408},[4022],{"type":49,"value":3110},{"type":44,"tag":1030,"props":4024,"children":4025},{"style":1053},[4026],{"type":49,"value":1415},{"type":44,"tag":1030,"props":4028,"children":4029},{"style":1064},[4030],{"type":49,"value":1078},{"type":44,"tag":1030,"props":4032,"children":4033},{"style":1070},[4034],{"type":49,"value":3123},{"type":44,"tag":1030,"props":4036,"children":4037},{"style":1064},[4038],{"type":49,"value":1078},{"type":44,"tag":1030,"props":4040,"children":4041},{"style":1064},[4042],{"type":49,"value":1571},{"type":44,"tag":1030,"props":4044,"children":4045},{"style":1064},[4046],{"type":49,"value":1067},{"type":44,"tag":1030,"props":4048,"children":4049},{"style":1070},[4050],{"type":49,"value":4051},"aal",{"type":44,"tag":1030,"props":4053,"children":4054},{"style":1064},[4055],{"type":49,"value":1078},{"type":44,"tag":1030,"props":4057,"children":4058},{"style":1053},[4059],{"type":49,"value":1663},{"type":44,"tag":1030,"props":4061,"children":4062},{"style":1064},[4063],{"type":49,"value":201},{"type":44,"tag":1030,"props":4065,"children":4066},{"style":1408},[4067],{"type":49,"value":3157},{"type":44,"tag":1030,"props":4069,"children":4070},{"style":1053},[4071],{"type":49,"value":3162},{"type":44,"tag":1030,"props":4073,"children":4074},{"style":1064},[4075],{"type":49,"value":1083},{"type":44,"tag":1030,"props":4077,"children":4078},{"class":1032,"line":1342},[4079],{"type":44,"tag":1030,"props":4080,"children":4081},{"emptyLinePlaceholder":1388},[4082],{"type":49,"value":1391},{"type":44,"tag":1030,"props":4084,"children":4085},{"class":1032,"line":1384},[4086],{"type":44,"tag":1030,"props":4087,"children":4088},{"style":1037},[4089],{"type":49,"value":4090},"\u002F\u002F Native enum values (e.g. auth.aal_level) come typed:\n",{"type":44,"tag":1030,"props":4092,"children":4093},{"class":1032,"line":1394},[4094,4099,4104,4109,4114,4119,4123,4127,4131,4135,4140,4144,4148,4152,4157,4161,4166,4170,4174],{"type":44,"tag":1030,"props":4095,"children":4096},{"style":2683},[4097],{"type":49,"value":4098},"type",{"type":44,"tag":1030,"props":4100,"children":4101},{"style":2713},[4102],{"type":49,"value":4103}," AalLevel",{"type":44,"tag":1030,"props":4105,"children":4106},{"style":1064},[4107],{"type":49,"value":4108}," =",{"type":44,"tag":1030,"props":4110,"children":4111},{"style":1053},[4112],{"type":49,"value":4113}," (",{"type":44,"tag":1030,"props":4115,"children":4116},{"style":1064},[4117],{"type":49,"value":4118},"typeof",{"type":44,"tag":1030,"props":4120,"children":4121},{"style":1053},[4122],{"type":49,"value":3803},{"type":44,"tag":1030,"props":4124,"children":4125},{"style":1064},[4126],{"type":49,"value":201},{"type":44,"tag":1030,"props":4128,"children":4129},{"style":1053},[4130],{"type":49,"value":18},{"type":44,"tag":1030,"props":4132,"children":4133},{"style":1064},[4134],{"type":49,"value":201},{"type":44,"tag":1030,"props":4136,"children":4137},{"style":1053},[4138],{"type":49,"value":4139},"nativeEnums",{"type":44,"tag":1030,"props":4141,"children":4142},{"style":1064},[4143],{"type":49,"value":201},{"type":44,"tag":1030,"props":4145,"children":4146},{"style":1053},[4147],{"type":49,"value":14},{"type":44,"tag":1030,"props":4149,"children":4150},{"style":1064},[4151],{"type":49,"value":201},{"type":44,"tag":1030,"props":4153,"children":4154},{"style":1053},[4155],{"type":49,"value":4156},"AalLevel)[",{"type":44,"tag":1030,"props":4158,"children":4159},{"style":1064},[4160],{"type":49,"value":1078},{"type":44,"tag":1030,"props":4162,"children":4163},{"style":1070},[4164],{"type":49,"value":4165},"Value",{"type":44,"tag":1030,"props":4167,"children":4168},{"style":1064},[4169],{"type":49,"value":1078},{"type":44,"tag":1030,"props":4171,"children":4172},{"style":1053},[4173],{"type":49,"value":2785},{"type":44,"tag":1030,"props":4175,"children":4176},{"style":1064},[4177],{"type":49,"value":1083},{"type":44,"tag":56,"props":4179,"children":4180},{},[4181,4186,4188,4193,4195,4200,4201,4206,4208,4214,4216,4222],{"type":44,"tag":60,"props":4182,"children":4183},{},[4184],{"type":49,"value":4185},"The admin root needs a one-time grant.",{"type":49,"value":4187}," A real Supabase project gives ",{"type":44,"tag":77,"props":4189,"children":4191},{"className":4190},[],[4192],{"type":49,"value":345},{"type":49,"value":4194}," no table privileges on ",{"type":44,"tag":77,"props":4196,"children":4198},{"className":4197},[],[4199],{"type":49,"value":179},{"type":49,"value":456},{"type":44,"tag":77,"props":4202,"children":4204},{"className":4203},[],[4205],{"type":49,"value":186},{"type":49,"value":4207}," — out of the box, the reads above fail with ",{"type":44,"tag":77,"props":4209,"children":4211},{"className":4210},[],[4212],{"type":49,"value":4213},"permission denied for table users",{"type":49,"value":4215}," (sqlState ",{"type":44,"tag":77,"props":4217,"children":4219},{"className":4218},[],[4220],{"type":49,"value":4221},"42501",{"type":49,"value":4223},"). Grant exactly what you read, narrowly:",{"type":44,"tag":1019,"props":4225,"children":4228},{"className":4226,"code":4227,"language":3846,"meta":1024,"style":1024},"language-sql shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","GRANT USAGE ON SCHEMA auth TO service_role;\nGRANT SELECT ON TABLE auth.users TO service_role;\n",[4229],{"type":44,"tag":77,"props":4230,"children":4231},{"__ignoreMap":1024},[4232,4240],{"type":44,"tag":1030,"props":4233,"children":4234},{"class":1032,"line":1033},[4235],{"type":44,"tag":1030,"props":4236,"children":4237},{},[4238],{"type":49,"value":4239},"GRANT USAGE ON SCHEMA auth TO service_role;\n",{"type":44,"tag":1030,"props":4241,"children":4242},{"class":1032,"line":1043},[4243],{"type":44,"tag":1030,"props":4244,"children":4245},{},[4246],{"type":49,"value":4247},"GRANT SELECT ON TABLE auth.users TO service_role;\n",{"type":44,"tag":56,"props":4249,"children":4250},{},[4251,4253,4258,4259,4264,4266,4270,4271,4276,4278,4282,4283,4289,4291,4296,4298,4303],{"type":49,"value":4252},"Other boundaries to respect: ",{"type":44,"tag":77,"props":4254,"children":4256},{"className":4255},[],[4257],{"type":49,"value":925},{"type":49,"value":456},{"type":44,"tag":77,"props":4260,"children":4262},{"className":4261},[],[4263],{"type":49,"value":932},{"type":49,"value":4265}," have ",{"type":44,"tag":60,"props":4267,"children":4268},{},[4269],{"type":49,"value":2289},{"type":49,"value":302},{"type":44,"tag":77,"props":4272,"children":4274},{"className":4273},[],[4275],{"type":49,"value":940},{"type":49,"value":4277},"; the admin root has ",{"type":44,"tag":60,"props":4279,"children":4280},{},[4281],{"type":49,"value":2289},{"type":49,"value":302},{"type":44,"tag":77,"props":4284,"children":4286},{"className":4285},[],[4287],{"type":49,"value":4288},".transaction",{"type":49,"value":4290}," (it is a separate contract-bound runtime sharing the pool — a transaction spanning both roots is out of scope); and for user ",{"type":44,"tag":195,"props":4292,"children":4293},{},[4294],{"type":49,"value":4295},"management",{"type":49,"value":4297}," (creating users, password resets) prefer the GoTrue Admin API — Supabase-internal schemas can drift across platform upgrades; direct ",{"type":44,"tag":77,"props":4299,"children":4301},{"className":4300},[],[4302],{"type":49,"value":345},{"type":49,"value":4304}," SQL is for ad-hoc admin reads.",{"type":44,"tag":86,"props":4306,"children":4308},{"id":4307},"workflow-grants",[4309],{"type":49,"value":664},{"type":44,"tag":56,"props":4311,"children":4312},{},[4313,4315,4320,4322,4328],{"type":49,"value":4314},"The concept: RLS policies are row filters on top of ordinary table privileges — a role with policies but no ",{"type":44,"tag":77,"props":4316,"children":4318},{"className":4317},[],[4319],{"type":49,"value":608},{"type":49,"value":4321}," gets ",{"type":44,"tag":77,"props":4323,"children":4325},{"className":4324},[],[4326],{"type":49,"value":4327},"permission denied",{"type":49,"value":4329},", not filtered rows. On Supabase the two directions are easy to get backwards:",{"type":44,"tag":93,"props":4331,"children":4332},{},[4333,4398],{"type":44,"tag":97,"props":4334,"children":4335},{},[4336,4348,4350,4356,4357,4362,4364,4370,4371,4377,4379,4384,4385,4390,4391,4396],{"type":44,"tag":60,"props":4337,"children":4338},{},[4339,4341,4346],{"type":49,"value":4340},"Your own ",{"type":44,"tag":77,"props":4342,"children":4344},{"className":4343},[],[4345],{"type":49,"value":637},{"type":49,"value":4347}," tables need nothing.",{"type":49,"value":4349}," Supabase ships ",{"type":44,"tag":77,"props":4351,"children":4353},{"className":4352},[],[4354],{"type":49,"value":4355},"ALTER DEFAULT PRIVILEGES",{"type":49,"value":884},{"type":44,"tag":77,"props":4358,"children":4360},{"className":4359},[],[4361],{"type":49,"value":637},{"type":49,"value":4363},", so tables created by ",{"type":44,"tag":77,"props":4365,"children":4367},{"className":4366},[],[4368],{"type":49,"value":4369},"prisma-next db init",{"type":49,"value":456},{"type":44,"tag":77,"props":4372,"children":4374},{"className":4373},[],[4375],{"type":49,"value":4376},"migrate",{"type":49,"value":4378}," inherit full grants for ",{"type":44,"tag":77,"props":4380,"children":4382},{"className":4381},[],[4383],{"type":49,"value":331},{"type":49,"value":456},{"type":44,"tag":77,"props":4386,"children":4388},{"className":4387},[],[4389],{"type":49,"value":338},{"type":49,"value":456},{"type":44,"tag":77,"props":4392,"children":4394},{"className":4393},[],[4395],{"type":49,"value":345},{"type":49,"value":4397}," automatically — the same as dashboard-created tables. RLS policies are what actually protect the rows; do not add per-table grants, and do not narrow the defaults unless you have a reason.",{"type":44,"tag":97,"props":4399,"children":4400},{},[4401,4406,4407,4412,4414,4419,4420,4425,4426,4431,4433,4439,4440,4446],{"type":44,"tag":60,"props":4402,"children":4403},{},[4404],{"type":49,"value":4405},"The one grant you do need is for admin reads of Supabase-internal tables",{"type":49,"value":3706},{"type":44,"tag":77,"props":4408,"children":4410},{"className":4409},[],[4411],{"type":49,"value":345},{"type":49,"value":4413}," has no table privileges on ",{"type":44,"tag":77,"props":4415,"children":4417},{"className":4416},[],[4418],{"type":49,"value":179},{"type":49,"value":456},{"type":44,"tag":77,"props":4421,"children":4423},{"className":4422},[],[4424],{"type":49,"value":186},{"type":49,"value":659},{"type":44,"tag":195,"props":4427,"children":4428},{},[4429],{"type":49,"value":4430},"Admin reads",{"type":49,"value":4432}," above for the narrow ",{"type":44,"tag":77,"props":4434,"children":4436},{"className":4435},[],[4437],{"type":49,"value":4438},"GRANT USAGE",{"type":49,"value":456},{"type":44,"tag":77,"props":4441,"children":4443},{"className":4442},[],[4444],{"type":49,"value":4445},"GRANT SELECT",{"type":49,"value":4447}," pair).",{"type":44,"tag":56,"props":4449,"children":4450},{},[4451,4453,4459,4461,4467,4468,4473],{"type":49,"value":4452},"Run grants via the Supabase SQL editor or ",{"type":44,"tag":77,"props":4454,"children":4456},{"className":4455},[],[4457],{"type":49,"value":4458},"psql",{"type":49,"value":4460},". Symptom of a missing grant: ",{"type":44,"tag":77,"props":4462,"children":4464},{"className":4463},[],[4465],{"type":49,"value":4466},"permission denied for table …",{"type":49,"value":4215},{"type":44,"tag":77,"props":4469,"children":4471},{"className":4470},[],[4472],{"type":49,"value":4221},{"type":49,"value":4474},") instead of an empty result.",{"type":44,"tag":86,"props":4476,"children":4478},{"id":4477},"workflow-connecting-to-a-real-supabase-project",[4479],{"type":49,"value":4480},"Workflow — Connecting to a real Supabase project",{"type":44,"tag":56,"props":4482,"children":4483},{},[4484,4486,4491,4493,4498,4500,4505],{"type":49,"value":4485},"The concept: the runtime needs a ",{"type":44,"tag":60,"props":4487,"children":4488},{},[4489],{"type":49,"value":4490},"direct, session-capable",{"type":49,"value":4492}," Postgres connection — it binds roles with session-scoped ",{"type":44,"tag":77,"props":4494,"children":4496},{"className":4495},[],[4497],{"type":49,"value":2900},{"type":49,"value":4499}," + ",{"type":44,"tag":77,"props":4501,"children":4503},{"className":4502},[],[4504],{"type":49,"value":562},{"type":49,"value":201},{"type":44,"tag":93,"props":4507,"children":4508},{},[4509,4534,4558],{"type":44,"tag":97,"props":4510,"children":4511},{},[4512,4517,4518,4524,4526,4532],{"type":44,"tag":60,"props":4513,"children":4514},{},[4515],{"type":49,"value":4516},"Session pooler",{"type":49,"value":4113},{"type":44,"tag":77,"props":4519,"children":4521},{"className":4520},[],[4522],{"type":49,"value":4523},"aws-0-\u003Cregion>.pooler.supabase.com:5432",{"type":49,"value":4525},", username ",{"type":44,"tag":77,"props":4527,"children":4529},{"className":4528},[],[4530],{"type":49,"value":4531},"postgres.\u003Cproject-ref>",{"type":49,"value":4533},") — works everywhere, IPv4. The default choice.",{"type":44,"tag":97,"props":4535,"children":4536},{},[4537,4542,4543,4549,4551,4556],{"type":44,"tag":60,"props":4538,"children":4539},{},[4540],{"type":49,"value":4541},"Direct connection",{"type":49,"value":4113},{"type":44,"tag":77,"props":4544,"children":4546},{"className":4545},[],[4547],{"type":49,"value":4548},"db.\u003Cproject-ref>.supabase.co:5432",{"type":49,"value":4550},") — works, but is ",{"type":44,"tag":60,"props":4552,"children":4553},{},[4554],{"type":49,"value":4555},"IPv6-only",{"type":49,"value":4557}," on new projects; from IPv4-only environments it fails DNS\u002Fconnect.",{"type":44,"tag":97,"props":4559,"children":4560},{},[4561,4566],{"type":44,"tag":60,"props":4562,"children":4563},{},[4564],{"type":49,"value":4565},"Transaction pooler (port 6543) — do not use.",{"type":49,"value":4567}," Transaction pooling breaks session GUCs; role binding will misbehave.",{"type":44,"tag":56,"props":4569,"children":4570},{},[4571,4577,4579,4584,4586,4591,4592,4598,4600,4606,4608,4614,4616,4621,4623,4628,4630,4636],{"type":44,"tag":77,"props":4572,"children":4574},{"className":4573},[],[4575],{"type":49,"value":4576},".env",{"type":49,"value":4578}," carries ",{"type":44,"tag":77,"props":4580,"children":4582},{"className":4581},[],[4583],{"type":49,"value":2776},{"type":49,"value":4585}," and the JWT key source. For current projects that is ",{"type":44,"tag":77,"props":4587,"children":4589},{"className":4588},[],[4590],{"type":49,"value":2827},{"type":49,"value":3706},{"type":44,"tag":77,"props":4593,"children":4595},{"className":4594},[],[4596],{"type":49,"value":4597},"https:\u002F\u002F\u003Cproject-ref>.supabase.co\u002Fauth\u002Fv1\u002F.well-known\u002Fjwks.json",{"type":49,"value":4599}," (local stack: ",{"type":44,"tag":77,"props":4601,"children":4603},{"className":4602},[],[4604],{"type":49,"value":4605},"http:\u002F\u002F127.0.0.1:54321\u002Fauth\u002Fv1\u002F.well-known\u002Fjwks.json",{"type":49,"value":4607},"). Only legacy HS256 projects use ",{"type":44,"tag":77,"props":4609,"children":4611},{"className":4610},[],[4612],{"type":49,"value":4613},"SUPABASE_JWT_SECRET",{"type":49,"value":4615}," (Project Settings → API → JWT Secret) — and note ",{"type":44,"tag":77,"props":4617,"children":4619},{"className":4618},[],[4620],{"type":49,"value":790},{"type":49,"value":4622}," prints a ",{"type":44,"tag":77,"props":4624,"children":4626},{"className":4625},[],[4627],{"type":49,"value":798},{"type":49,"value":4629}," even on ES256 projects, so don't infer the mode from its presence; check the JWKS endpoint or a token's header ",{"type":44,"tag":77,"props":4631,"children":4633},{"className":4632},[],[4634],{"type":49,"value":4635},"alg",{"type":49,"value":201},{"type":44,"tag":86,"props":4638,"children":4640},{"id":4639},"common-pitfalls",[4641],{"type":49,"value":4642},"Common Pitfalls",{"type":44,"tag":4644,"props":4645,"children":4646},"ol",{},[4647,4657,4721,4759,4794,4837,4885,4922,4961,5010],{"type":44,"tag":97,"props":4648,"children":4649},{},[4650,4655],{"type":44,"tag":60,"props":4651,"children":4652},{},[4653],{"type":49,"value":4654},"Using the transaction pooler (port 6543).",{"type":49,"value":4656}," Session GUC role binding requires a session-capable connection — use the session pooler (5432) or the direct connection.",{"type":44,"tag":97,"props":4658,"children":4659},{},[4660,4684,4686,4691,4693,4698,4700,4705,4707,4712,4714,4719],{"type":44,"tag":60,"props":4661,"children":4662},{},[4663,4665,4670,4672,4677,4678,4683],{"type":49,"value":4664},"Wiring ",{"type":44,"tag":77,"props":4666,"children":4668},{"className":4667},[],[4669],{"type":49,"value":729},{"type":49,"value":4671}," because ",{"type":44,"tag":77,"props":4673,"children":4675},{"className":4674},[],[4676],{"type":49,"value":790},{"type":49,"value":4622},{"type":44,"tag":77,"props":4679,"children":4681},{"className":4680},[],[4682],{"type":49,"value":798},{"type":49,"value":201},{"type":49,"value":4685}," Current projects sign ES256; ",{"type":44,"tag":77,"props":4687,"children":4689},{"className":4688},[],[4690],{"type":49,"value":925},{"type":49,"value":4692}," then throws ",{"type":44,"tag":77,"props":4694,"children":4696},{"className":4695},[],[4697],{"type":49,"value":745},{"type":49,"value":4699}," explaining the token is ES256 and the client needs ",{"type":44,"tag":77,"props":4701,"children":4703},{"className":4702},[],[4704],{"type":49,"value":679},{"type":49,"value":4706},". Configure ",{"type":44,"tag":77,"props":4708,"children":4710},{"className":4709},[],[4711],{"type":49,"value":2827},{"type":49,"value":4713},"; reserve ",{"type":44,"tag":77,"props":4715,"children":4717},{"className":4716},[],[4718],{"type":49,"value":729},{"type":49,"value":4720}," for legacy HS256 projects.",{"type":44,"tag":97,"props":4722,"children":4723},{},[4724,4729,4731,4736,4738,4743,4745,4750,4752,4757],{"type":44,"tag":60,"props":4725,"children":4726},{},[4727],{"type":49,"value":4728},"Grants in the wrong direction.",{"type":49,"value":4730}," Your ",{"type":44,"tag":77,"props":4732,"children":4734},{"className":4733},[],[4735],{"type":49,"value":637},{"type":49,"value":4737}," tables need no grants (Supabase's default privileges cover them; RLS protects the rows) — the grant you need is the narrow ",{"type":44,"tag":77,"props":4739,"children":4741},{"className":4740},[],[4742],{"type":49,"value":179},{"type":49,"value":4744}," pair for ",{"type":44,"tag":77,"props":4746,"children":4748},{"className":4747},[],[4749],{"type":49,"value":345},{"type":49,"value":4751}," admin reads. ",{"type":44,"tag":77,"props":4753,"children":4755},{"className":4754},[],[4756],{"type":49,"value":4327},{"type":49,"value":4758}," (42501) means a missing grant, not a filtered result.",{"type":44,"tag":97,"props":4760,"children":4761},{},[4762,4786,4788,4793],{"type":44,"tag":60,"props":4763,"children":4764},{},[4765,4767,4772,4773,4778,4780,4785],{"type":49,"value":4766},"Expecting ",{"type":44,"tag":77,"props":4768,"children":4770},{"className":4769},[],[4771],{"type":49,"value":454},{"type":49,"value":456},{"type":44,"tag":77,"props":4774,"children":4776},{"className":4775},[],[4777],{"type":49,"value":462},{"type":49,"value":4779}," on the top-level ",{"type":44,"tag":77,"props":4781,"children":4783},{"className":4782},[],[4784],{"type":49,"value":261},{"type":49,"value":201},{"type":49,"value":4787}," The Supabase db is role-first; bind a role, query the ",{"type":44,"tag":77,"props":4789,"children":4791},{"className":4790},[],[4792],{"type":49,"value":492},{"type":49,"value":201},{"type":44,"tag":97,"props":4795,"children":4796},{},[4797,4808,4810,4815,4817,4822,4824,4829,4830,4835],{"type":44,"tag":60,"props":4798,"children":4799},{},[4800,4802],{"type":49,"value":4801},"Forgetting ",{"type":44,"tag":77,"props":4803,"children":4805},{"className":4804},[],[4806],{"type":49,"value":4807},"await",{"type":49,"value":4809}," — on the ",{"type":44,"tag":77,"props":4811,"children":4813},{"className":4812},[],[4814],{"type":49,"value":82},{"type":49,"value":4816}," factory and on ",{"type":44,"tag":77,"props":4818,"children":4820},{"className":4819},[],[4821],{"type":49,"value":140},{"type":49,"value":4823},". Both are async; ",{"type":44,"tag":77,"props":4825,"children":4827},{"className":4826},[],[4828],{"type":49,"value":147},{"type":49,"value":456},{"type":44,"tag":77,"props":4831,"children":4833},{"className":4832},[],[4834],{"type":49,"value":154},{"type":49,"value":4836}," are not.",{"type":44,"tag":97,"props":4838,"children":4839},{},[4840,4862,4864,4869,4871,4876,4878,4883],{"type":44,"tag":60,"props":4841,"children":4842},{},[4843,4844,4849,4850,4855,4856,4861],{"type":49,"value":4766},{"type":44,"tag":77,"props":4845,"children":4847},{"className":4846},[],[4848],{"type":49,"value":940},{"type":49,"value":884},{"type":44,"tag":77,"props":4851,"children":4853},{"className":4852},[],[4854],{"type":49,"value":925},{"type":49,"value":456},{"type":44,"tag":77,"props":4857,"children":4859},{"className":4858},[],[4860],{"type":49,"value":932},{"type":49,"value":201},{"type":49,"value":4863}," Admin access to ",{"type":44,"tag":77,"props":4865,"children":4867},{"className":4866},[],[4868],{"type":49,"value":179},{"type":49,"value":4870}," is ",{"type":44,"tag":77,"props":4872,"children":4874},{"className":4873},[],[4875],{"type":49,"value":345},{"type":49,"value":4877},"-only by construction — and even ",{"type":44,"tag":77,"props":4879,"children":4881},{"className":4880},[],[4882],{"type":49,"value":345},{"type":49,"value":4884}," needs the one-time narrow grant first.",{"type":44,"tag":97,"props":4886,"children":4887},{},[4888,4906,4908,4913,4915,4920],{"type":44,"tag":60,"props":4889,"children":4890},{},[4891,4893,4898,4900,4905],{"type":49,"value":4892},"A ",{"type":44,"tag":77,"props":4894,"children":4896},{"className":4895},[],[4897],{"type":49,"value":2261},{"type":49,"value":4899}," block whose target lacks ",{"type":44,"tag":77,"props":4901,"children":4903},{"className":4902},[],[4904],{"type":49,"value":120},{"type":49,"value":201},{"type":49,"value":4907}," Emit fails with ",{"type":44,"tag":77,"props":4909,"children":4911},{"className":4910},[],[4912],{"type":49,"value":2276},{"type":49,"value":4914}," — add ",{"type":44,"tag":77,"props":4916,"children":4918},{"className":4917},[],[4919],{"type":49,"value":120},{"type":49,"value":4921}," to the model.",{"type":44,"tag":97,"props":4923,"children":4924},{},[4925,4930,4932,4938,4940,4945,4947,4953,4955,4960],{"type":44,"tag":60,"props":4926,"children":4927},{},[4928],{"type":49,"value":4929},"Unquoted camelCase columns or missing casts in predicates.",{"type":49,"value":4931}," Predicates are verbatim SQL: ",{"type":44,"tag":77,"props":4933,"children":4935},{"className":4934},[],[4936],{"type":49,"value":4937},"\"userId\"",{"type":49,"value":4939}," needs quotes; compare uuid to ",{"type":44,"tag":77,"props":4941,"children":4943},{"className":4942},[],[4944],{"type":49,"value":127},{"type":49,"value":4946}," with a ",{"type":44,"tag":77,"props":4948,"children":4950},{"className":4949},[],[4951],{"type":49,"value":4952},"::uuid",{"type":49,"value":4954}," cast where the column isn't already ",{"type":44,"tag":77,"props":4956,"children":4958},{"className":4957},[],[4959],{"type":49,"value":2322},{"type":49,"value":201},{"type":44,"tag":97,"props":4962,"children":4963},{},[4964,4980,4982,4987,4989,4994,4996,5001,5002,5008],{"type":44,"tag":60,"props":4965,"children":4966},{},[4967,4969,4974,4975],{"type":49,"value":4968},"Passing both ",{"type":44,"tag":77,"props":4970,"children":4972},{"className":4971},[],[4973],{"type":49,"value":679},{"type":49,"value":317},{"type":44,"tag":77,"props":4976,"children":4978},{"className":4977},[],[4979],{"type":49,"value":729},{"type":49,"value":4981}," (or neither) — the ",{"type":44,"tag":77,"props":4983,"children":4985},{"className":4984},[],[4986],{"type":49,"value":82},{"type":49,"value":4988}," promise rejects with ",{"type":44,"tag":77,"props":4990,"children":4992},{"className":4991},[],[4993],{"type":49,"value":737},{"type":49,"value":4995},". It's an async factory, so the misconfiguration surfaces as a rejection (",{"type":44,"tag":77,"props":4997,"children":4999},{"className":4998},[],[5000],{"type":49,"value":4807},{"type":49,"value":456},{"type":44,"tag":77,"props":5003,"children":5005},{"className":5004},[],[5006],{"type":49,"value":5007},".catch",{"type":49,"value":5009},"), not a synchronous throw.",{"type":44,"tag":97,"props":5011,"children":5012},{},[5013,5018,5020,5026,5028,5033,5035,5040],{"type":44,"tag":60,"props":5014,"children":5015},{},[5016],{"type":49,"value":5017},"Treating an RLS-filtered write as an error.",{"type":49,"value":5019}," An ",{"type":44,"tag":77,"props":5021,"children":5023},{"className":5022},[],[5024],{"type":49,"value":5025},"UPDATE",{"type":49,"value":5027}," against a row the role can't see affects ",{"type":44,"tag":60,"props":5029,"children":5030},{},[5031],{"type":49,"value":5032},"0 rows",{"type":49,"value":5034}," (no exception); only ",{"type":44,"tag":77,"props":5036,"children":5038},{"className":5037},[],[5039],{"type":49,"value":2230},{"type":49,"value":5041}," violations raise.",{"type":44,"tag":86,"props":5043,"children":5045},{"id":5044},"what-prisma-next-doesnt-do-yet",[5046],{"type":49,"value":622},{"type":44,"tag":93,"props":5048,"children":5049},{},[5050,5088,5129,5146,5170],{"type":44,"tag":97,"props":5051,"children":5052},{},[5053,5065,5067,5072,5074,5079,5081,5087],{"type":44,"tag":60,"props":5054,"children":5055},{},[5056,5058,5063],{"type":49,"value":5057},"No ",{"type":44,"tag":77,"props":5059,"children":5061},{"className":5060},[],[5062],{"type":49,"value":980},{"type":49,"value":5064}," subpath on the extension",{"type":49,"value":5066}," — it can't register through the target façade's ",{"type":44,"tag":77,"props":5068,"children":5070},{"className":5069},[],[5071],{"type":49,"value":988},{"type":49,"value":5073},"; wiring goes through the low-level config's ",{"type":44,"tag":77,"props":5075,"children":5077},{"className":5076},[],[5078],{"type":49,"value":360},{"type":49,"value":5080}," as shown above. File interest via ",{"type":44,"tag":77,"props":5082,"children":5084},{"className":5083},[],[5085],{"type":49,"value":5086},"prisma-next-feedback",{"type":49,"value":201},{"type":44,"tag":97,"props":5089,"children":5090},{},[5091,5101,5103,5108,5109,5114,5116,5121,5123,5128],{"type":44,"tag":60,"props":5092,"children":5093},{},[5094,5099],{"type":44,"tag":77,"props":5095,"children":5097},{"className":5096},[],[5098],{"type":49,"value":608},{"type":49,"value":5100}," authoring.",{"type":49,"value":5102}," Table privileges are not contract elements; the one grant a Supabase app needs (the ",{"type":44,"tag":77,"props":5104,"children":5106},{"className":5105},[],[5107],{"type":49,"value":345},{"type":49,"value":302},{"type":44,"tag":77,"props":5110,"children":5112},{"className":5111},[],[5113],{"type":49,"value":179},{"type":49,"value":5115}," pair for admin reads) is run once by hand (SQL editor \u002F ",{"type":44,"tag":77,"props":5117,"children":5119},{"className":5118},[],[5120],{"type":49,"value":4458},{"type":49,"value":5122},"). If you want grants managed by the contract, file via ",{"type":44,"tag":77,"props":5124,"children":5126},{"className":5125},[],[5127],{"type":49,"value":5086},{"type":49,"value":201},{"type":44,"tag":97,"props":5130,"children":5131},{},[5132,5144],{"type":44,"tag":60,"props":5133,"children":5134},{},[5135,5137,5142],{"type":49,"value":5136},"Transactions spanning the app root and the ",{"type":44,"tag":77,"props":5138,"children":5140},{"className":5139},[],[5141],{"type":49,"value":940},{"type":49,"value":5143}," admin root.",{"type":49,"value":5145}," The two roots are separate contract-bound runtimes sharing one pool; a cross-root transaction is not supported.",{"type":44,"tag":97,"props":5147,"children":5148},{},[5149,5154,5156,5161,5163,5168],{"type":44,"tag":60,"props":5150,"children":5151},{},[5152],{"type":49,"value":5153},"Triggers \u002F functions as contract elements.",{"type":49,"value":5155}," The classic \"create a profile row on signup\" ",{"type":44,"tag":77,"props":5157,"children":5159},{"className":5158},[],[5160],{"type":49,"value":166},{"type":49,"value":5162}," trigger is authored as raw SQL against your database, not in the contract. ",{"type":44,"tag":77,"props":5164,"children":5166},{"className":5165},[],[5167],{"type":49,"value":127},{"type":49,"value":5169}," etc. appear only inside opaque policy predicate strings.",{"type":44,"tag":97,"props":5171,"children":5172},{},[5173,5186],{"type":44,"tag":60,"props":5174,"children":5175},{},[5176,5178,5184],{"type":49,"value":5177},"Supabase Realtime, storage uploads, PostgREST \u002F ",{"type":44,"tag":77,"props":5179,"children":5181},{"className":5180},[],[5182],{"type":49,"value":5183},"@supabase\u002Fsupabase-js",{"type":49,"value":5185}," interop, edge runtimes.",{"type":49,"value":5187}," Out of scope for the extension — it speaks Postgres directly (Node.js \u002F Bun).",{"type":44,"tag":86,"props":5189,"children":5191},{"id":5190},"reference-files",[5192],{"type":49,"value":5193},"Reference Files",{"type":44,"tag":93,"props":5195,"children":5196},{},[5197,5215,5226],{"type":44,"tag":97,"props":5198,"children":5199},{},[5200,5206,5208,5213],{"type":44,"tag":77,"props":5201,"children":5203},{"className":5202},[],[5204],{"type":49,"value":5205},"examples\u002Fsupabase",{"type":49,"value":5207}," — the canonical runnable app: config, contract, ",{"type":44,"tag":77,"props":5209,"children":5211},{"className":5210},[],[5212],{"type":49,"value":233},{"type":49,"value":5214},", acceptance tests, README.",{"type":44,"tag":97,"props":5216,"children":5217},{},[5218,5224],{"type":44,"tag":77,"props":5219,"children":5221},{"className":5220},[],[5222],{"type":49,"value":5223},"packages\u002F3-extensions\u002Fsupabase\u002FREADME.md",{"type":49,"value":5225}," — package-level reference (JWT modes, role-binding model, unsupported scope).",{"type":44,"tag":97,"props":5227,"children":5228},{},[5229,5235,5237,5243,5244,5249,5250,5256],{"type":44,"tag":77,"props":5230,"children":5232},{"className":5231},[],[5233],{"type":49,"value":5234},"packages\u002F3-extensions\u002Fsupabase\u002Fsrc\u002Fruntime\u002Fsupabase.ts",{"type":49,"value":5236}," — the authoritative options\u002Ftype surface (",{"type":44,"tag":77,"props":5238,"children":5240},{"className":5239},[],[5241],{"type":49,"value":5242},"SupabaseOptions",{"type":49,"value":114},{"type":44,"tag":77,"props":5245,"children":5247},{"className":5246},[],[5248],{"type":49,"value":492},{"type":49,"value":114},{"type":44,"tag":77,"props":5251,"children":5253},{"className":5252},[],[5254],{"type":49,"value":5255},"ServiceRoleDb",{"type":49,"value":129},{"type":44,"tag":86,"props":5258,"children":5260},{"id":5259},"checklist",[5261],{"type":49,"value":5262},"Checklist",{"type":44,"tag":93,"props":5264,"children":5267},{"className":5265},[5266],"contains-task-list",[5268,5302,5341,5363,5400,5441,5484,5500,5509],{"type":44,"tag":97,"props":5269,"children":5272},{"className":5270},[5271],"task-list-item",[5273,5278,5279,5285,5287,5293,5295,5300],{"type":44,"tag":5274,"props":5275,"children":5277},"input",{"disabled":1388,"type":5276},"checkbox",[],{"type":49,"value":302},{"type":44,"tag":77,"props":5280,"children":5282},{"className":5281},[],[5283],{"type":49,"value":5284},"extensions: [supabasePack]",{"type":49,"value":5286}," in the low-level ",{"type":44,"tag":77,"props":5288,"children":5290},{"className":5289},[],[5291],{"type":49,"value":5292},"defineConfig",{"type":49,"value":5294}," (no ",{"type":44,"tag":77,"props":5296,"children":5298},{"className":5297},[],[5299],{"type":49,"value":980},{"type":49,"value":5301}," subpath exists).",{"type":44,"tag":97,"props":5303,"children":5305},{"className":5304},[5271],[5306,5309,5311,5316,5318,5324,5325,5331,5333,5339],{"type":44,"tag":5274,"props":5307,"children":5308},{"disabled":1388,"type":5276},[],{"type":49,"value":5310}," Cross-space FK typed ",{"type":44,"tag":77,"props":5312,"children":5314},{"className":5313},[],[5315],{"type":49,"value":1772},{"type":49,"value":5317}," with explicit ",{"type":44,"tag":77,"props":5319,"children":5321},{"className":5320},[],[5322],{"type":49,"value":5323},"fields",{"type":49,"value":456},{"type":44,"tag":77,"props":5326,"children":5328},{"className":5327},[],[5329],{"type":49,"value":5330},"references",{"type":49,"value":5332}," (+ ",{"type":44,"tag":77,"props":5334,"children":5336},{"className":5335},[],[5337],{"type":49,"value":5338},"onDelete",{"type":49,"value":5340}," if wanted).",{"type":44,"tag":97,"props":5342,"children":5344},{"className":5343},[5271],[5345,5348,5350,5355,5357,5362],{"type":44,"tag":5274,"props":5346,"children":5347},{"disabled":1388,"type":5276},[],{"type":49,"value":5349}," Every policy target model carries ",{"type":44,"tag":77,"props":5351,"children":5353},{"className":5352},[],[5354],{"type":49,"value":120},{"type":49,"value":5356},"; predicates quote camelCase columns and cast for ",{"type":44,"tag":77,"props":5358,"children":5360},{"className":5359},[],[5361],{"type":49,"value":127},{"type":49,"value":201},{"type":44,"tag":97,"props":5364,"children":5366},{"className":5365},[5271],[5367,5370,5371,5376,5378,5384,5386,5391,5393,5398],{"type":44,"tag":5274,"props":5368,"children":5369},{"disabled":1388,"type":5276},[],{"type":49,"value":302},{"type":44,"tag":77,"props":5372,"children":5374},{"className":5373},[],[5375],{"type":49,"value":233},{"type":49,"value":5377}," uses ",{"type":44,"tag":77,"props":5379,"children":5381},{"className":5380},[],[5382],{"type":49,"value":5383},"await supabase\u003CContract>({ contractJson, url, jwksUrl | jwtSecret })",{"type":49,"value":5385}," — exactly one JWT key source; ",{"type":44,"tag":77,"props":5387,"children":5389},{"className":5388},[],[5390],{"type":49,"value":679},{"type":49,"value":5392}," for current projects, ",{"type":44,"tag":77,"props":5394,"children":5396},{"className":5395},[],[5397],{"type":49,"value":729},{"type":49,"value":5399}," only for legacy HS256.",{"type":44,"tag":97,"props":5401,"children":5403},{"className":5402},[5271],[5404,5407,5409,5414,5416,5421,5422,5427,5428,5433,5434,5439],{"type":44,"tag":5274,"props":5405,"children":5406},{"disabled":1388,"type":5276},[],{"type":49,"value":5408}," Queries go through a ",{"type":44,"tag":77,"props":5410,"children":5412},{"className":5411},[],[5413],{"type":49,"value":492},{"type":49,"value":5415}," from ",{"type":44,"tag":77,"props":5417,"children":5419},{"className":5418},[],[5420],{"type":49,"value":925},{"type":49,"value":456},{"type":44,"tag":77,"props":5423,"children":5425},{"className":5424},[],[5426],{"type":49,"value":932},{"type":49,"value":456},{"type":44,"tag":77,"props":5429,"children":5431},{"className":5430},[],[5432],{"type":49,"value":3349},{"type":49,"value":602},{"type":44,"tag":77,"props":5435,"children":5437},{"className":5436},[],[5438],{"type":49,"value":925},{"type":49,"value":5440}," is awaited.",{"type":44,"tag":97,"props":5442,"children":5444},{"className":5443},[5271],[5445,5448,5449,5454,5455,5460,5462,5468,5470,5476,5477,5482],{"type":44,"tag":5274,"props":5446,"children":5447},{"disabled":1388,"type":5276},[],{"type":49,"value":302},{"type":44,"tag":77,"props":5450,"children":5452},{"className":5451},[],[5453],{"type":49,"value":179},{"type":49,"value":456},{"type":44,"tag":77,"props":5456,"children":5458},{"className":5457},[],[5459],{"type":49,"value":186},{"type":49,"value":5461}," reads go through ",{"type":44,"tag":77,"props":5463,"children":5465},{"className":5464},[],[5466],{"type":49,"value":5467},"asServiceRole().supabase",{"type":49,"value":5469}," only, after the one-time narrow grant (",{"type":44,"tag":77,"props":5471,"children":5473},{"className":5472},[],[5474],{"type":49,"value":5475},"GRANT USAGE ON SCHEMA auth",{"type":49,"value":4499},{"type":44,"tag":77,"props":5478,"children":5480},{"className":5479},[],[5481],{"type":49,"value":4445},{"type":49,"value":5483}," on the tables you read).",{"type":44,"tag":97,"props":5485,"children":5487},{"className":5486},[5271],[5488,5491,5493,5498],{"type":44,"tag":5274,"props":5489,"children":5490},{"disabled":1388,"type":5276},[],{"type":49,"value":5492}," No per-table grants added for your own ",{"type":44,"tag":77,"props":5494,"children":5496},{"className":5495},[],[5497],{"type":49,"value":637},{"type":49,"value":5499}," tables — Supabase default privileges cover them; RLS does the protecting.",{"type":44,"tag":97,"props":5501,"children":5503},{"className":5502},[5271],[5504,5507],{"type":44,"tag":5274,"props":5505,"children":5506},{"disabled":1388,"type":5276},[],{"type":49,"value":5508}," Connection is session-capable: session pooler or direct connection — never the 6543 transaction pooler.",{"type":44,"tag":97,"props":5510,"children":5512},{"className":5511},[5271],[5513,5516,5518,5523,5525,5530,5531,5536],{"type":44,"tag":5274,"props":5514,"children":5515},{"disabled":1388,"type":5276},[],{"type":49,"value":5517}," Did NOT confabulate a ",{"type":44,"tag":77,"props":5519,"children":5521},{"className":5520},[],[5522],{"type":49,"value":980},{"type":49,"value":5524}," subpath, a top-level ",{"type":44,"tag":77,"props":5526,"children":5528},{"className":5527},[],[5529],{"type":49,"value":454},{"type":49,"value":114},{"type":44,"tag":77,"props":5532,"children":5534},{"className":5533},[],[5535],{"type":49,"value":940},{"type":49,"value":5537}," on non-service roles, or grant authoring in the contract.",{"type":44,"tag":5539,"props":5540,"children":5541},"style",{},[5542],{"type":49,"value":5543},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":5545,"total":1384},[5546,5562,5577,5589,5602,5615,5633],{"slug":5547,"name":5547,"fn":5548,"description":5549,"org":5550,"tags":5551,"stars":26,"repoUrl":27,"updatedAt":5561},"prisma-next","guide Prisma Next project setup and usage","Route a vague Prisma Next prompt to the right specific skill. Use for \"help me with Prisma Next\", \"what is Prisma Next\", \"explain Prisma Next\", \"I'm new to PN\", \"where do I start\", \"what can I do with Prisma Next\", \"what can I do next with Prisma\", \"just ran createprisma\", \"tour of Prisma Next\", \"Prisma Next overview\", and comparison questions like \"Prisma Next vs Prisma 7\", \"PN vs Drizzle\", \"PN vs Kysely\", \"PN vs TypeORM\". Do NOT use when the prompt clearly matches a workflow skill — adoption \u002F quickstart \u002F first-touch orientation \u002F brownfield introspection, schema \u002F contract editing, migration authoring (db update \u002F migration plan \u002F migrate), migration review on deploy \u002F concurrent migrations, queries \u002F db.orm \u002F db.sql \u002F TypedSQL, Supabase \u002F RLS \u002F role binding, runtime \u002F db.ts \u002F middleware wiring, build \u002F Vite plugin \u002F Next.js plugin, debug \u002F structured error envelopes \u002F PN-* error codes, or feedback \u002F bug report \u002F feature request — load that sibling skill directly.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5552,5555,5558,5559],{"name":5553,"slug":5554,"type":15},"Database","database",{"name":5556,"slug":5557,"type":15},"Next.js","next-js",{"name":9,"slug":8,"type":15},{"name":5560,"slug":1023,"type":15},"TypeScript","2026-07-17T05:32:04.322957",{"slug":5563,"name":5563,"fn":5564,"description":5565,"org":5566,"tags":5567,"stars":26,"repoUrl":27,"updatedAt":5576},"prisma-next-build","integrate Prisma Next into build systems","Wire Prisma Next into the project's build system with the right build-tool plugin — Vite today via @prisma-next\u002Fvite-plugin-contract-emit (Vite 7 \u002F 8); Next.js \u002F Webpack \u002F esbuild \u002F Rollup \u002F Turbopack are named as gaps rather than fabricated. Always offers the Vite plugin proactively when the project is using Vite. Use for vite plugin, vite-plugin, vite.config.ts, prismaVitePlugin, contract emit on save, HMR, hot reload contract, dev server, Next.js plugin, next plugin, withPrismaNext, webpack plugin, esbuild plugin, rollup plugin, build integration, dev server plugin, vite 7, vite 8.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5568,5571,5572,5573],{"name":5569,"slug":5570,"type":15},"Deployment","deployment",{"name":5556,"slug":5557,"type":15},{"name":9,"slug":8,"type":15},{"name":5574,"slug":5575,"type":15},"Vite","vite","2026-07-02T07:31:36.108254",{"slug":221,"name":221,"fn":5578,"description":5579,"org":5580,"tags":5581,"stars":26,"repoUrl":27,"updatedAt":5588},"edit Prisma Next data contracts and models","Edit the Prisma Next data contract — add models, fields, relations, indexes, enums, value objects (composite types), type aliases, namespaces (Postgres schemas), cross-contract foreign keys (cross-space FK), polymorphic types (`@@discriminator` \u002F `@@base`), use extension namespaces (`pgvector.Vector(...)`, `cipherstash.EncryptedString(...)`), wire `prisma-next.config.ts` with `defineConfig` from the `@prisma-next\u002F\u003Ctarget>\u002Fconfig` façade, and run `prisma-next contract emit`. Use for schema, models, fields, attributes, soft delete, paranoid, scopes, validations, callbacks, prisma schema, PSL, contract.prisma, contract.ts, contract.json, contract.d.ts, `@prisma-next\u002Fpostgres\u002Fconfig`, `@prisma-next\u002Fpostgres\u002Fcontract-builder`, `@prisma-next\u002Fpostgres\u002Fcontrol`, `@prisma-next\u002Fmongo\u002Fconfig`, `@prisma-next\u002Fmongo\u002Fcontract-builder`, `extensions:`, pgvector, cipherstash, postgis, paradedb, supabase, `@prisma-next\u002Fextension-supabase`, `@@control`, control policy, managed, tolerated, external, observed.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5582,5585,5586,5587],{"name":5583,"slug":5584,"type":15},"Data Modeling","data-modeling",{"name":5553,"slug":5554,"type":15},{"name":9,"slug":8,"type":15},{"name":5560,"slug":1023,"type":15},"2026-07-30T05:30:10.426962",{"slug":5590,"name":5590,"fn":5591,"description":5592,"org":5593,"tags":5594,"stars":26,"repoUrl":27,"updatedAt":5601},"prisma-next-debug","debug and recover from Prisma Next errors","Read a Prisma Next structured error envelope and route to the right recovery — code, domain, severity, why, fix, meta. Use for error, exception, my emit failed, my query won't typecheck, my query crashed, my migration won't apply, MIGRATION.HASH_MISMATCH, BUDGET.ROWS_EXCEEDED, BUDGET.TIME_EXCEEDED, RUNTIME.ABORTED, PLAN.HASH_MISMATCH, CONTRACT.MARKER_MISSING, PN-RUN-3001, PN-RUN-3002, PN-RUN-3030, PN-MIG-2001, PN-CLI-4011, PN-SCHEMA-0001, drift, capability missing, planner conflict, prisma studio, EXPLAIN, query log, db.end, db.close, script won't exit, hangs, close connection, pool.end, client is closed.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5595,5596,5599,5600],{"name":5553,"slug":5554,"type":15},{"name":5597,"slug":5598,"type":15},"Debugging","debugging",{"name":5556,"slug":5557,"type":15},{"name":9,"slug":8,"type":15},"2026-07-24T05:37:10.436314",{"slug":5086,"name":5086,"fn":5603,"description":5604,"org":5605,"tags":5606,"stars":26,"repoUrl":27,"updatedAt":5614},"report Prisma Next issues and feedback","Hand a Prisma Next question or report off to the team — file a GitHub issue (bug or feature request), or route Q&A \u002F design discussion \u002F direct-team-contact to the Prisma Discord at pris.ly\u002Fdiscord. Use for bug, bug report, file an issue, report a bug, feature request, missing feature, this should be a feature, file this, this is a bug, this is broken, surprising behaviour, this doesn't work, file feedback, send feedback, capability gap, file via prisma-next-feedback, ask the team, talk to the team, talk to the Prisma team, talk to Prisma, Discord, Prisma Discord, Q&A, design feedback, is this the intended way, how should I do X, extension author question, extension author needs help.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5607,5610,5613],{"name":5608,"slug":5609,"type":15},"Documentation","documentation",{"name":5611,"slug":5612,"type":15},"GitHub","github",{"name":9,"slug":8,"type":15},"2026-07-02T07:31:34.870809",{"slug":5616,"name":5616,"fn":5617,"description":5618,"org":5619,"tags":5620,"stars":26,"repoUrl":27,"updatedAt":5632},"prisma-next-migration-review","review and resolve Prisma Next migrations","Review what Prisma Next migrations will run on merge or deploy, render the migration graph, resolve concurrent \u002F diamond-convergence conflicts, and configure environment refs for CI. Use for \"what migrations are going to run\", \"what runs on deploy\", merge conflict, diamond convergence, concurrent migrations, migration status, ref management, staging, production, MIGRATION.DIVERGED, MIGRATION.NO_MARKER, MIGRATION.MARKER_NOT_IN_HISTORY, prisma migrate status, prisma migrate diff, prisma migrate resolve.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5621,5624,5627,5628,5631],{"name":5622,"slug":5623,"type":15},"CI\u002FCD","ci-cd",{"name":5625,"slug":5626,"type":15},"Code Review","code-review",{"name":5553,"slug":5554,"type":15},{"name":5629,"slug":5630,"type":15},"Migration","migration",{"name":9,"slug":8,"type":15},"2026-07-24T05:37:11.422323",{"slug":274,"name":274,"fn":5634,"description":5635,"org":5636,"tags":5637,"stars":26,"repoUrl":27,"updatedAt":5642},"author and manage Prisma Next migrations","Author Prisma Next migrations — choose db update vs migration plan, edit the framework-rendered migration.ts (replace placeholder sentinels with dataTransform closures), recover from MIGRATION.HASH_MISMATCH or PN-MIG-2001 unfilled placeholder. Use for prisma migrate dev, prisma migrate deploy, prisma db push, db update, db update --dry-run, migration plan, migrate, migration new, migration show, db verify, db sign, data migration, this.dataTransform, dataTransform, placeholder, generated migration.ts, edit migration.ts, MIGRATION.HASH_MISMATCH, schema drift.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5638,5639,5640,5641],{"name":5553,"slug":5554,"type":15},{"name":5629,"slug":5630,"type":15},{"name":9,"slug":8,"type":15},{"name":5560,"slug":1023,"type":15},"2026-07-24T05:37:13.469138",{"items":5644,"total":1631},[5645,5652,5659,5666,5673,5679,5687,5694,5706,5717,5727,5735],{"slug":5547,"name":5547,"fn":5548,"description":5549,"org":5646,"tags":5647,"stars":26,"repoUrl":27,"updatedAt":5561},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5648,5649,5650,5651],{"name":5553,"slug":5554,"type":15},{"name":5556,"slug":5557,"type":15},{"name":9,"slug":8,"type":15},{"name":5560,"slug":1023,"type":15},{"slug":5563,"name":5563,"fn":5564,"description":5565,"org":5653,"tags":5654,"stars":26,"repoUrl":27,"updatedAt":5576},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5655,5656,5657,5658],{"name":5569,"slug":5570,"type":15},{"name":5556,"slug":5557,"type":15},{"name":9,"slug":8,"type":15},{"name":5574,"slug":5575,"type":15},{"slug":221,"name":221,"fn":5578,"description":5579,"org":5660,"tags":5661,"stars":26,"repoUrl":27,"updatedAt":5588},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5662,5663,5664,5665],{"name":5583,"slug":5584,"type":15},{"name":5553,"slug":5554,"type":15},{"name":9,"slug":8,"type":15},{"name":5560,"slug":1023,"type":15},{"slug":5590,"name":5590,"fn":5591,"description":5592,"org":5667,"tags":5668,"stars":26,"repoUrl":27,"updatedAt":5601},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5669,5670,5671,5672],{"name":5553,"slug":5554,"type":15},{"name":5597,"slug":5598,"type":15},{"name":5556,"slug":5557,"type":15},{"name":9,"slug":8,"type":15},{"slug":5086,"name":5086,"fn":5603,"description":5604,"org":5674,"tags":5675,"stars":26,"repoUrl":27,"updatedAt":5614},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5676,5677,5678],{"name":5608,"slug":5609,"type":15},{"name":5611,"slug":5612,"type":15},{"name":9,"slug":8,"type":15},{"slug":5616,"name":5616,"fn":5617,"description":5618,"org":5680,"tags":5681,"stars":26,"repoUrl":27,"updatedAt":5632},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5682,5683,5684,5685,5686],{"name":5622,"slug":5623,"type":15},{"name":5625,"slug":5626,"type":15},{"name":5553,"slug":5554,"type":15},{"name":5629,"slug":5630,"type":15},{"name":9,"slug":8,"type":15},{"slug":274,"name":274,"fn":5634,"description":5635,"org":5688,"tags":5689,"stars":26,"repoUrl":27,"updatedAt":5642},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5690,5691,5692,5693],{"name":5553,"slug":5554,"type":15},{"name":5629,"slug":5630,"type":15},{"name":9,"slug":8,"type":15},{"name":5560,"slug":1023,"type":15},{"slug":253,"name":253,"fn":5695,"description":5696,"org":5697,"tags":5698,"stars":26,"repoUrl":27,"updatedAt":5705},"write Prisma Next queries for database operations","Write Prisma Next queries for Postgres, SQLite, or Mongo — pick a lane (Postgres\u002FSQLite `db.orm.\u003CModel>` + `db.sql.\u003Ctable>`; Mongo `db.orm.\u003Croot>` + `db.query.from(...)` pipeline builder), filter \u002F project \u002F sort \u002F paginate, eager-load with `.include(...)`, Postgres\u002FSQLite `db.transaction(...)`, Postgres\u002FSQLite ORM `.aggregate(...)`, Mongo aggregations via query builder, namespace-aware accessors (`db.orm.\u003Cns>.\u003CModel>`, `db.sql.\u003Cns>.\u003Ctable>`). Triggers: query, where, match, select, project, orderBy, take, skip, include, lookup, first, all, count, aggregate, group, create, update, delete, upsert, returning, transaction, db.close, script teardown, variant, polymorphism, drizzle-style, kysely-style. Notes: `.all()` is a Thenable (just `await` it), iterators are single-use (`RUNTIME.ITERATOR_CONSUMED`), Postgres `count` is `number` while sum\u002Favg\u002Fmin\u002Fmax are `number | null`, ranges use chained `.where()` or `and(...)` (no `.between(...)`).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5699,5700,5701,5702,5703],{"name":5553,"slug":5554,"type":15},{"name":5556,"slug":5557,"type":15},{"name":24,"slug":25,"type":15},{"name":9,"slug":8,"type":15},{"name":5704,"slug":3846,"type":15},"SQL","2026-07-17T05:32:03.35373",{"slug":5707,"name":5707,"fn":5708,"description":5709,"org":5710,"tags":5711,"stars":26,"repoUrl":27,"updatedAt":5716},"prisma-next-quickstart","adopt Prisma Next in projects","Adopt Prisma Next into a new project, onto an existing database, or as the first move after a bootstrap tool dropped you into a scaffold. Use for \"what can I do with Prisma Next\", \"what can I do next with Prisma\", \"where do I start\", \"what should I do first\", \"just ran createprisma\", \"createprisma\", \"npx createprisma\", \"npx create-prisma\", \"first steps\", \"first query\", \"I have a scaffolded Prisma Next project what now\"; for `pnpm dlx prisma-next init` greenfield setup; and for `prisma-next contract infer` + `db sign` against an existing database. Also covers the connect-write-read first-arc orientation, the day-to-day commands (`contract emit`, `db init`, `db update`, `migration plan`, `migrate`, `db schema`, `db verify`), and routing to `prisma-next-contract` \u002F `prisma-next-queries` \u002F `prisma-next-runtime` for the next move. Flags: --target, --authoring, --schema-path, --probe-db, --output.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5712,5713,5714,5715],{"name":5553,"slug":5554,"type":15},{"name":20,"slug":21,"type":15},{"name":9,"slug":8,"type":15},{"name":5560,"slug":1023,"type":15},"2026-07-24T05:37:12.462072",{"slug":241,"name":241,"fn":5718,"description":5719,"org":5720,"tags":5721,"stars":26,"repoUrl":27,"updatedAt":5726},"configure Prisma Next runtime and database connections","Wire the Prisma Next runtime — `db.ts` setup using `postgres\u003CContract>(...)` from `@prisma-next\u002Fpostgres\u002Fruntime`, `sqlite\u003CContract>(...)` from `@prisma-next\u002Fsqlite\u002Fruntime`, or `mongo\u003CContract>(...)` from `@prisma-next\u002Fmongo\u002Fruntime`; middleware composition (telemetry from `@prisma-next\u002Fmiddleware-telemetry`; lints and budgets), `DATABASE_URL` config, per-environment branching, switching between Postgres, SQLite, and Mongo façades. Use for db.ts, postgres(), sqlite(), mongo(), middleware, telemetry, lints, budgets, DATABASE_URL, .env, connection pool, poolOptions, dev vs prod config, transactions, db.transaction, read replicas, multi-database, script won't exit, hangs, close connection, db.end, db.close, pool.end, [Symbol.asyncDispose], await using.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5722,5723,5724,5725],{"name":5553,"slug":5554,"type":15},{"name":5556,"slug":5557,"type":15},{"name":24,"slug":25,"type":15},{"name":9,"slug":8,"type":15},"2026-07-17T05:32:05.347316",{"slug":4,"name":4,"fn":5,"description":6,"org":5728,"tags":5729,"stars":26,"repoUrl":27,"updatedAt":28},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5730,5731,5732,5733,5734],{"name":13,"slug":14,"type":15},{"name":20,"slug":21,"type":15},{"name":24,"slug":25,"type":15},{"name":9,"slug":8,"type":15},{"name":17,"slug":18,"type":15},{"slug":5736,"name":5736,"fn":5737,"description":5738,"org":5739,"tags":5740,"stars":5748,"repoUrl":5749,"updatedAt":5750},"prisma-cli","run Prisma CLI commands","Prisma ORM CLI commands reference covering init, generate, migrate, db, dev, studio, validate, format, debug, and mcp. Use for ORM\u002Fdatabase CLI workflows, not Prisma Compute app deployment. For Prisma Compute, `@prisma\u002Fcli app deploy`, `compute:deploy`, `create-prisma --deploy`, apps, deployments, logs, or domains, use the `prisma-compute` skill instead. Triggers on \"prisma init\", \"prisma generate\", \"prisma migrate\", \"prisma db\", \"prisma studio\", \"prisma mcp\".",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5741,5744,5745,5746,5747],{"name":5742,"slug":5743,"type":15},"CLI","cli",{"name":5553,"slug":5554,"type":15},{"name":5629,"slug":5630,"type":15},{"name":20,"slug":21,"type":15},{"name":9,"slug":8,"type":15},44,"https:\u002F\u002Fgithub.com\u002Fprisma\u002Fskills","2026-04-06T18:48:29.140467"]