@hasna/shortlinks 0.2.0 → 0.2.2

package/dist/serve/index.js

@@ -33,7 +33,7 @@ var __toESM = (mod, isNodeMode, target) => {
 var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
 var __require = import.meta.require;
 
-// node_modules/postgres-array/index.js
+// node_modules/.pnpm/postgres-array@2.0.0/node_modules/postgres-array/index.js
 var require_postgres_array = __commonJS((exports) => {
   exports.parse = function(source, transform) {
     return new ArrayParser(source, transform).parse();
@@ -129,7 +129,7 @@ var require_postgres_array = __commonJS((exports) => {
   }
 });
 
-// node_modules/pg-types/lib/arrayParser.js
+// node_modules/.pnpm/pg-types@2.2.0/node_modules/pg-types/lib/arrayParser.js
 var require_arrayParser = __commonJS((exports, module) => {
   var array = require_postgres_array();
   module.exports = {
@@ -143,7 +143,7 @@ var require_arrayParser = __commonJS((exports, module) => {
   };
 });
 
-// node_modules/postgres-date/index.js
+// node_modules/.pnpm/postgres-date@1.0.7/node_modules/postgres-date/index.js
 var require_postgres_date = __commonJS((exports, module) => {
   var DATE_TIME = /(\d{1,})-(\d{2})-(\d{2}) (\d{2}):(\d{2}):(\d{2})(\.\d{1,})?.*?( BC)?$/;
   var DATE = /^(\d{1,})-(\d{2})-(\d{2})( BC)?$/;
@@ -228,7 +228,7 @@ var require_postgres_date = __commonJS((exports, module) => {
   }
 });
 
-// node_modules/xtend/mutable.js
+// node_modules/.pnpm/xtend@4.0.2/node_modules/xtend/mutable.js
 var require_mutable = __commonJS((exports, module) => {
   module.exports = extend;
   var hasOwnProperty = Object.prototype.hasOwnProperty;
@@ -245,7 +245,7 @@ var require_mutable = __commonJS((exports, module) => {
   }
 });
 
-// node_modules/postgres-interval/index.js
+// node_modules/.pnpm/postgres-interval@1.2.0/node_modules/postgres-interval/index.js
 var require_postgres_interval = __commonJS((exports, module) => {
   var extend = require_mutable();
   module.exports = PostgresInterval;
@@ -337,7 +337,7 @@ var require_postgres_interval = __commonJS((exports, module) => {
   }
 });
 
-// node_modules/postgres-bytea/index.js
+// node_modules/.pnpm/postgres-bytea@1.0.1/node_modules/postgres-bytea/index.js
 var require_postgres_bytea = __commonJS((exports, module) => {
   var bufferFrom = Buffer.from || Buffer;
   module.exports = function parseBytea(input) {
@@ -370,7 +370,7 @@ var require_postgres_bytea = __commonJS((exports, module) => {
   };
 });
 
-// node_modules/pg-types/lib/textParsers.js
+// node_modules/.pnpm/pg-types@2.2.0/node_modules/pg-types/lib/textParsers.js
 var require_textParsers = __commonJS((exports, module) => {
   var array = require_postgres_array();
   var arrayParser = require_arrayParser();
@@ -573,7 +573,7 @@ var require_textParsers = __commonJS((exports, module) => {
   };
 });
 
-// node_modules/pg-int8/index.js
+// node_modules/.pnpm/pg-int8@1.0.1/node_modules/pg-int8/index.js
 var require_pg_int8 = __commonJS((exports, module) => {
   var BASE = 1e6;
   function readInt8(buffer) {
@@ -650,7 +650,7 @@ var require_pg_int8 = __commonJS((exports, module) => {
   module.exports = readInt8;
 });
 
-// node_modules/pg-types/lib/binaryParsers.js
+// node_modules/.pnpm/pg-types@2.2.0/node_modules/pg-types/lib/binaryParsers.js
 var require_binaryParsers = __commonJS((exports, module) => {
   var parseInt64 = require_pg_int8();
   var parseBits = function(data, bits, offset, invert, callback) {
@@ -849,7 +849,7 @@ var require_binaryParsers = __commonJS((exports, module) => {
   };
 });
 
-// node_modules/pg-types/lib/builtins.js
+// node_modules/.pnpm/pg-types@2.2.0/node_modules/pg-types/lib/builtins.js
 var require_builtins = __commonJS((exports, module) => {
   module.exports = {
     BOOL: 16,
@@ -915,7 +915,7 @@ var require_builtins = __commonJS((exports, module) => {
   };
 });
 
-// node_modules/pg-types/index.js
+// node_modules/.pnpm/pg-types@2.2.0/node_modules/pg-types/index.js
 var require_pg_types = __commonJS((exports) => {
   var textParsers = require_textParsers();
   var binaryParsers = require_binaryParsers();
@@ -954,7 +954,7 @@ var require_pg_types = __commonJS((exports) => {
   });
 });
 
-// node_modules/pg/lib/defaults.js
+// node_modules/.pnpm/pg@8.22.0/node_modules/pg/lib/defaults.js
 var require_defaults = __commonJS((exports, module) => {
   var user;
   try {
@@ -973,6 +973,7 @@ var require_defaults = __commonJS((exports, module) => {
     idleTimeoutMillis: 30000,
     client_encoding: "",
     ssl: false,
+    sslnegotiation: undefined,
     application_name: undefined,
     fallback_application_name: undefined,
     options: undefined,
@@ -994,11 +995,10 @@ var require_defaults = __commonJS((exports, module) => {
   });
 });
 
-// node_modules/pg/lib/utils.js
+// node_modules/.pnpm/pg@8.22.0/node_modules/pg/lib/utils.js
 var require_utils = __commonJS((exports, module) => {
   var defaults = require_defaults();
-  var util = __require("util");
-  var { isDate } = util.types || util;
+  var { isDate } = __require("util/types");
   function escapeElement(elementRepresentation) {
     const escaped = elementRepresentation.replace(/\\/g, "\\\\").replace(/"/g, "\\\"");
     return '"' + escaped + '"';
@@ -1007,28 +1007,23 @@ var require_utils = __commonJS((exports, module) => {
     let result = "{";
     for (let i = 0;i < val.length; i++) {
       if (i > 0) {
-        result = result + ",";
-      }
-      if (val[i] === null || typeof val[i] === "undefined") {
-        result = result + "NULL";
-      } else if (Array.isArray(val[i])) {
-        result = result + arrayString(val[i]);
-      } else if (ArrayBuffer.isView(val[i])) {
-        let item = val[i];
+        result += ",";
+      }
+      let item = val[i];
+      if (item == null) {
+        result += "NULL";
+      } else if (Array.isArray(item)) {
+        result += arrayString(item);
+      } else if (ArrayBuffer.isView(item)) {
         if (!(item instanceof Buffer)) {
-          const buf = Buffer.from(item.buffer, item.byteOffset, item.byteLength);
-          if (buf.length === item.byteLength) {
-            item = buf;
-          } else {
-            item = buf.slice(item.byteOffset, item.byteOffset + item.byteLength);
-          }
+          item = Buffer.from(item.buffer, item.byteOffset, item.byteLength);
         }
         result += "\\\\x" + item.toString("hex");
       } else {
-        result += escapeElement(prepareValue(val[i]));
+        result += escapeElement(prepareValue(item));
       }
     }
-    result = result + "}";
+    result += "}";
     return result;
   }
   var prepareValue = function(val, seen) {
@@ -1040,11 +1035,7 @@ var require_utils = __commonJS((exports, module) => {
         return val;
       }
       if (ArrayBuffer.isView(val)) {
-        const buf = Buffer.from(val.buffer, val.byteOffset, val.byteLength);
-        if (buf.length === val.byteLength) {
-          return buf;
-        }
-        return buf.slice(val.byteOffset, val.byteOffset + val.byteLength);
+        return Buffer.from(val.buffer, val.byteOffset, val.byteLength);
       }
       if (isDate(val)) {
         if (defaults.parseInputDatesAsUTC) {
@@ -1153,43 +1144,8 @@ var require_utils = __commonJS((exports, module) => {
   };
 });
 
-// node_modules/pg/lib/crypto/utils-legacy.js
-var require_utils_legacy = __commonJS((exports, module) => {
-  var nodeCrypto = __require("crypto");
-  function md5(string) {
-    return nodeCrypto.createHash("md5").update(string, "utf-8").digest("hex");
-  }
-  function postgresMd5PasswordHash(user, password, salt) {
-    const inner = md5(password + user);
-    const outer = md5(Buffer.concat([Buffer.from(inner), salt]));
-    return "md5" + outer;
-  }
-  function sha256(text) {
-    return nodeCrypto.createHash("sha256").update(text).digest();
-  }
-  function hashByName(hashName, text) {
-    hashName = hashName.replace(/(\D)-/, "$1");
-    return nodeCrypto.createHash(hashName).update(text).digest();
-  }
-  function hmacSha256(key, msg) {
-    return nodeCrypto.createHmac("sha256", key).update(msg).digest();
-  }
-  async function deriveKey(password, salt, iterations) {
-    return nodeCrypto.pbkdf2Sync(password, salt, iterations, 32, "sha256");
-  }
-  module.exports = {
-    postgresMd5PasswordHash,
-    randomBytes: nodeCrypto.randomBytes,
-    deriveKey,
-    sha256,
-    hashByName,
-    hmacSha256,
-    md5
-  };
-});
-
-// node_modules/pg/lib/crypto/utils-webcrypto.js
-var require_utils_webcrypto = __commonJS((exports, module) => {
+// node_modules/.pnpm/pg@8.22.0/node_modules/pg/lib/crypto/utils.js
+var require_utils2 = __commonJS((exports, module) => {
   var nodeCrypto = __require("crypto");
   module.exports = {
     postgresMd5PasswordHash,
@@ -1237,17 +1193,7 @@ var require_utils_webcrypto = __commonJS((exports, module) => {
   }
 });
 
-// node_modules/pg/lib/crypto/utils.js
-var require_utils2 = __commonJS((exports, module) => {
-  var useLegacyCrypto = parseInt(process.versions && process.versions.node && process.versions.node.split(".")[0]) < 15;
-  if (useLegacyCrypto) {
-    module.exports = require_utils_legacy();
-  } else {
-    module.exports = require_utils_webcrypto();
-  }
-});
-
-// node_modules/pg/lib/crypto/cert-signatures.js
+// node_modules/.pnpm/pg@8.22.0/node_modules/pg/lib/crypto/cert-signatures.js
 var require_cert_signatures = __commonJS((exports, module) => {
   function x509Error(msg, cert) {
     return new Error("SASL channel binding: " + msg + " when parsing public certificate " + cert.toString("base64"));
@@ -1359,11 +1305,17 @@ var require_cert_signatures = __commonJS((exports, module) => {
   module.exports = { signatureAlgorithmHashFromCertificate };
 });
 
-// node_modules/pg/lib/crypto/sasl.js
+// node_modules/.pnpm/pg@8.22.0/node_modules/pg/lib/crypto/sasl.js
 var require_sasl = __commonJS((exports, module) => {
   var crypto2 = require_utils2();
   var { signatureAlgorithmHashFromCertificate } = require_cert_signatures();
-  function startSession(mechanisms, stream) {
+  function saslprep(password) {
+    const nonAsciiSpace = /[\u00A0\u1680\u2000-\u200B\u202F\u205F\u3000]/g;
+    const mappedToNothing = /[\u00AD\u034F\u1806\u180B\u180C\u180D\u200C\u200D\u2060\uFE00-\uFE0F\uFEFF]/g;
+    return password.replace(nonAsciiSpace, " ").replace(mappedToNothing, "").normalize("NFKC");
+  }
+  var DEFAULT_MAX_SCRAM_ITERATIONS = 1e5;
+  function startSession(mechanisms, stream, scramMaxIterations = DEFAULT_MAX_SCRAM_ITERATIONS) {
     const candidates = ["SCRAM-SHA-256"];
     if (stream)
       candidates.unshift("SCRAM-SHA-256-PLUS");
@@ -1380,7 +1332,8 @@ var require_sasl = __commonJS((exports, module) => {
       mechanism,
       clientNonce,
       response: gs2Header + ",,n=*,r=" + clientNonce,
-      message: "SASLInitialResponse"
+      message: "SASLInitialResponse",
+      scramMaxIterations
     };
   }
   async function continueSession(session, password, serverData, stream) {
@@ -1402,6 +1355,10 @@ var require_sasl = __commonJS((exports, module) => {
     } else if (sv.nonce.length === session.clientNonce.length) {
       throw new Error("SASL: SCRAM-SERVER-FIRST-MESSAGE: server nonce is too short");
     }
+    const scramMaxIterations = typeof session.scramMaxIterations === "number" ? session.scramMaxIterations : DEFAULT_MAX_SCRAM_ITERATIONS;
+    if (scramMaxIterations !== 0 && sv.iteration > scramMaxIterations) {
+      throw new Error("SASL: SCRAM-SERVER-FIRST-MESSAGE: iteration count " + sv.iteration + " exceeds scramMaxIterations of " + scramMaxIterations);
+    }
     const clientFirstMessageBare = "n=*,r=" + session.clientNonce;
     const serverFirstMessage = "r=" + sv.nonce + ",s=" + sv.salt + ",i=" + sv.iteration;
     let channelBinding = stream ? "eSws" : "biws";
@@ -1417,7 +1374,7 @@ var require_sasl = __commonJS((exports, module) => {
     const clientFinalMessageWithoutProof = "c=" + channelBinding + ",r=" + sv.nonce;
     const authMessage = clientFirstMessageBare + "," + serverFirstMessage + "," + clientFinalMessageWithoutProof;
     const saltBytes = Buffer.from(sv.salt, "base64");
-    const saltedPassword = await crypto2.deriveKey(password, saltBytes, sv.iteration);
+    const saltedPassword = await crypto2.deriveKey(saslprep(password), saltBytes, sv.iteration);
     const clientKey = await crypto2.hmacSha256(saltedPassword, "Client Key");
     const storedKey = await crypto2.sha256(clientKey);
     const clientSignature = await crypto2.hmacSha256(storedKey, authMessage);
@@ -1491,7 +1448,11 @@ var require_sasl = __commonJS((exports, module) => {
   }
   function parseServerFinalMessage(serverData) {
     const attrPairs = parseAttributePairs(serverData);
+    const error = attrPairs.get("e");
     const serverSignature = attrPairs.get("v");
+    if (error) {
+      throw new Error(`SASL: SCRAM-SERVER-FINAL-MESSAGE: server returned error: "${error}"`);
+    }
     if (!serverSignature) {
       throw new Error("SASL: SCRAM-SERVER-FINAL-MESSAGE: server signature is missing");
     } else if (!isBase64(serverSignature)) {
@@ -1519,11 +1480,12 @@ var require_sasl = __commonJS((exports, module) => {
   module.exports = {
     startSession,
     continueSession,
-    finalizeSession
+    finalizeSession,
+    DEFAULT_MAX_SCRAM_ITERATIONS
   };
 });
 
-// node_modules/pg/lib/type-overrides.js
+// node_modules/.pnpm/pg@8.22.0/node_modules/pg/lib/type-overrides.js
 var require_type_overrides = __commonJS((exports, module) => {
   var types = require_pg_types();
   function TypeOverrides(userTypes) {
@@ -1555,14 +1517,14 @@ var require_type_overrides = __commonJS((exports, module) => {
   module.exports = TypeOverrides;
 });
 
-// node_modules/pg-connection-string/index.js
+// node_modules/.pnpm/pg-connection-string@2.14.0/node_modules/pg-connection-string/index.js
 var require_pg_connection_string = __commonJS((exports, module) => {
   function parse(str, options = {}) {
     if (str.charAt(0) === "/") {
       const config2 = str.split(" ");
       return { host: config2[0], database: config2[1] };
     }
-    const config = {};
+    const config = Object.create(null);
     let result;
     let dummyHost = false;
     if (/ |%[^a-f0-9]|%[a-f0-9][^a-f0-9]/i.test(str)) {
@@ -1610,6 +1572,9 @@ var require_pg_connection_string = __commonJS((exports, module) => {
     if (config.sslcert || config.sslkey || config.sslrootcert || config.sslmode) {
       config.ssl = {};
     }
+    if (config.sslnegotiation === "direct" && config.ssl === undefined) {
+      config.ssl = true;
+    }
     const fs = config.sslcert || config.sslkey || config.sslrootcert ? __require("fs") : null;
     if (config.sslcert) {
       config.ssl.cert = fs.readFileSync(config.sslcert).toString();
@@ -1681,7 +1646,7 @@ var require_pg_connection_string = __commonJS((exports, module) => {
         c[key] = value;
       }
       return c;
-    }, {});
+    }, Object.create(null));
     return connectionOptions;
   }
   function toClientConfig(config) {
@@ -1708,7 +1673,7 @@ var require_pg_connection_string = __commonJS((exports, module) => {
         }
       }
       return c;
-    }, {});
+    }, Object.create(null));
     return poolConfig;
   }
   function parseIntoClientConfig(str) {
@@ -1733,7 +1698,7 @@ See https://www.postgresql.org/docs/current/libpq-ssl.html for libpq SSL mode de
   parse.parseIntoClientConfig = parseIntoClientConfig;
 });
 
-// node_modules/pg/lib/connection-parameters.js
+// node_modules/.pnpm/pg@8.22.0/node_modules/pg/lib/connection-parameters.js
 var require_connection_parameters = __commonJS((exports, module) => {
   var dns = __require("dns");
   var defaults = require_defaults();
@@ -1808,6 +1773,13 @@ var require_connection_parameters = __commonJS((exports, module) => {
           enumerable: false
         });
       }
+      this.sslnegotiation = val("sslnegotiation", config, "PGSSLNEGOTIATION");
+      if (this.sslnegotiation !== undefined && this.sslnegotiation !== "postgres" && this.sslnegotiation !== "direct") {
+        throw new Error(`Invalid sslnegotiation value: "${this.sslnegotiation}". Valid values are "postgres" and "direct".`);
+      }
+      if (this.sslnegotiation === "direct" && !this.ssl) {
+        throw new Error("sslnegotiation=direct requires SSL to be enabled");
+      }
       this.client_encoding = val("client_encoding", config);
       this.replication = val("replication", config);
       this.isDomainSocket = !(this.host || "").indexOf("/");
@@ -1846,6 +1818,7 @@ var require_connection_parameters = __commonJS((exports, module) => {
       add(params, ssl, "sslkey");
       add(params, ssl, "sslcert");
       add(params, ssl, "sslrootcert");
+      add(params, this, "sslnegotiation");
       if (this.database) {
         params.push("dbname=" + quoteParamValue(this.database));
       }
@@ -1872,7 +1845,7 @@ var require_connection_parameters = __commonJS((exports, module) => {
   module.exports = ConnectionParameters;
 });
 
-// node_modules/pg/lib/result.js
+// node_modules/.pnpm/pg@8.22.0/node_modules/pg/lib/result.js
 var require_result = __commonJS((exports, module) => {
   var types = require_pg_types();
   var matchRegexp = /^([A-Za-z]+)(?: (\d+))?(?: (\d+))?/;
@@ -1944,7 +1917,7 @@ var require_result = __commonJS((exports, module) => {
       if (this.fields.length) {
         this._parsers = new Array(fieldDescriptions.length);
       }
-      const row = {};
+      const row = Object.create(null);
       for (let i = 0;i < fieldDescriptions.length; i++) {
         const desc = fieldDescriptions[i];
         row[desc.name] = null;
@@ -1960,7 +1933,7 @@ var require_result = __commonJS((exports, module) => {
   module.exports = Result;
 });
 
-// node_modules/pg/lib/query.js
+// node_modules/.pnpm/pg@8.22.0/node_modules/pg/lib/query.js
 var require_query = __commonJS((exports, module) => {
   var { EventEmitter } = __require("events");
   var Result = require_result();
@@ -2129,6 +2102,8 @@ var require_query = __commonJS((exports, module) => {
           valueMapper: utils.prepareValue
         });
       } catch (err) {
+        connection.close({ type: "S", name: this.name });
+        connection.sync();
         this.handleError(err, connection);
         return;
       }
@@ -2146,7 +2121,7 @@ var require_query = __commonJS((exports, module) => {
   module.exports = Query;
 });
 
-// node_modules/pg-protocol/dist/messages.js
+// node_modules/.pnpm/pg-protocol@1.15.0/node_modules/pg-protocol/dist/messages.js
 var require_messages = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.NoticeMessage = exports.DataRowMessage = exports.CommandCompleteMessage = exports.ReadyForQueryMessage = exports.NotificationResponseMessage = exports.BackendKeyDataMessage = exports.AuthenticationMD5Password = exports.ParameterStatusMessage = exports.ParameterDescriptionMessage = exports.RowDescriptionMessage = exports.Field = exports.CopyResponse = exports.CopyDataMessage = exports.DatabaseError = exports.copyDone = exports.emptyQuery = exports.replicationStart = exports.portalSuspended = exports.noData = exports.closeComplete = exports.bindComplete = exports.parseComplete = undefined;
@@ -2322,7 +2297,7 @@ var require_messages = __commonJS((exports) => {
   exports.NoticeMessage = NoticeMessage;
 });
 
-// node_modules/pg-protocol/dist/buffer-writer.js
+// node_modules/.pnpm/pg-protocol@1.15.0/node_modules/pg-protocol/dist/buffer-writer.js
 var require_buffer_writer = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.Writer = undefined;
@@ -2376,6 +2351,19 @@ var require_buffer_writer = __commonJS((exports) => {
       this.offset += len;
       return this;
     }
+    addInt32PrefixedString(string) {
+      const len = Buffer.byteLength(string);
+      this.ensure(4 + len);
+      const buffer = this.buffer;
+      let offset = this.offset;
+      buffer[offset++] = len >>> 24 & 255;
+      buffer[offset++] = len >>> 16 & 255;
+      buffer[offset++] = len >>> 8 & 255;
+      buffer[offset++] = len >>> 0 & 255;
+      buffer.write(string, offset, "utf-8");
+      this.offset = offset + len;
+      return this;
+    }
     add(otherBuffer) {
       this.ensure(otherBuffer.length);
       otherBuffer.copy(this.buffer, this.offset);
@@ -2397,11 +2385,15 @@ var require_buffer_writer = __commonJS((exports) => {
       this.buffer = Buffer.allocUnsafe(this.size);
       return result;
     }
+    clear() {
+      this.offset = 5;
+      this.headerPosition = 0;
+    }
   }
   exports.Writer = Writer;
 });
 
-// node_modules/pg-protocol/dist/serializer.js
+// node_modules/.pnpm/pg-protocol@1.15.0/node_modules/pg-protocol/dist/serializer.js
 var require_serializer = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.serialize = undefined;
@@ -2427,7 +2419,7 @@ var require_serializer = __commonJS((exports) => {
     return writer.addCString(password2).flush(112);
   };
   var sendSASLInitialResponseMessage = function(mechanism, initialResponse) {
-    writer.addCString(mechanism).addInt32(Buffer.byteLength(initialResponse)).addString(initialResponse);
+    writer.addCString(mechanism).addInt32PrefixedString(initialResponse);
     return writer.flush(112);
   };
   var sendSCRAMClientFinalMessage = function(additionalData) {
@@ -2465,8 +2457,7 @@ var require_serializer = __commonJS((exports) => {
         paramWriter.add(mappedVal);
       } else {
         writer.addInt16(0);
-        paramWriter.addInt32(Buffer.byteLength(mappedVal));
-        paramWriter.addString(mappedVal);
+        paramWriter.addInt32PrefixedString(mappedVal);
       }
     }
   };
@@ -2478,7 +2469,13 @@ var require_serializer = __commonJS((exports) => {
     const len = values.length;
     writer.addCString(portal).addCString(statement);
     writer.addInt16(len);
-    writeValues(values, config.valueMapper);
+    try {
+      writeValues(values, config.valueMapper);
+    } catch (err) {
+      writer.clear();
+      paramWriter.clear();
+      throw err;
+    }
     writer.addInt16(len);
     writer.add(paramWriter.flush());
     writer.addInt16(1);
@@ -2564,7 +2561,7 @@ var require_serializer = __commonJS((exports) => {
   exports.serialize = serialize;
 });
 
-// node_modules/pg-protocol/dist/buffer-reader.js
+// node_modules/.pnpm/pg-protocol@1.15.0/node_modules/pg-protocol/dist/buffer-reader.js
 var require_buffer_reader = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.BufferReader = undefined;
@@ -2607,7 +2604,7 @@ var require_buffer_reader = __commonJS((exports) => {
     cstring() {
       const start = this.offset;
       let end = start;
-      while (this.buffer[end++] !== 0) {}
+      while (this.buffer[end++]) {}
       this.offset = end;
       return this.buffer.toString(this.encoding, start, end - 1);
     }
@@ -2620,7 +2617,7 @@ var require_buffer_reader = __commonJS((exports) => {
   exports.BufferReader = BufferReader;
 });
 
-// node_modules/pg-protocol/dist/parser.js
+// node_modules/.pnpm/pg-protocol@1.15.0/node_modules/pg-protocol/dist/parser.js
 var require_parser = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.Parser = undefined;
@@ -2925,10 +2922,11 @@ var require_parser = __commonJS((exports) => {
   };
 });
 
-// node_modules/pg-protocol/dist/index.js
+// node_modules/.pnpm/pg-protocol@1.15.0/node_modules/pg-protocol/dist/index.js
 var require_dist = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
-  exports.DatabaseError = exports.serialize = exports.parse = undefined;
+  exports.DatabaseError = exports.serialize = undefined;
+  exports.parse = parse;
   var messages_1 = require_messages();
   Object.defineProperty(exports, "DatabaseError", { enumerable: true, get: function() {
     return messages_1.DatabaseError;
@@ -2943,16 +2941,15 @@ var require_dist = __commonJS((exports) => {
     stream.on("data", (buffer) => parser.parse(buffer, callback));
     return new Promise((resolve2) => stream.on("end", () => resolve2()));
   }
-  exports.parse = parse;
 });
 
-// node_modules/pg-cloudflare/dist/empty.js
+// node_modules/.pnpm/pg-cloudflare@1.4.0/node_modules/pg-cloudflare/dist/empty.js
 var require_empty = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.default = {};
 });
 
-// node_modules/pg/lib/stream.js
+// node_modules/.pnpm/pg@8.22.0/node_modules/pg/lib/stream.js
 var require_stream = __commonJS((exports, module) => {
   var { getStream, getSecureStream } = getStreamFuncs();
   module.exports = {
@@ -3007,11 +3004,12 @@ var require_stream = __commonJS((exports, module) => {
   }
 });
 
-// node_modules/pg/lib/connection.js
+// node_modules/.pnpm/pg@8.22.0/node_modules/pg/lib/connection.js
 var require_connection = __commonJS((exports, module) => {
   var EventEmitter = __require("events").EventEmitter;
   var { parse, serialize } = require_dist();
-  var { getStream, getSecureStream } = require_stream();
+  var stream = require_stream();
+  var { getStream } = stream;
   var flushBuffer = serialize.flush();
   var syncBuffer = serialize.sync();
   var endBuffer = serialize.end();
@@ -3028,6 +3026,7 @@ var require_connection = __commonJS((exports, module) => {
       this._keepAliveInitialDelayMillis = config.keepAliveInitialDelayMillis;
       this.parsedStatements = {};
       this.ssl = config.ssl || false;
+      this.sslNegotiation = config.sslNegotiation || "postgres";
       this._ending = false;
       this._emitMessage = false;
       const self = this;
@@ -3061,6 +3060,11 @@ var require_connection = __commonJS((exports, module) => {
       if (!this.ssl) {
         return this.attachListeners(this.stream);
       }
+      if (this.sslNegotiation === "direct") {
+        return this.stream.once("connect", function() {
+          self.upgradeToSSL(host, reportStreamError);
+        });
+      }
       this.stream.once("data", function(buffer) {
         const responseCode = buffer.toString("utf8");
         switch (responseCode) {
@@ -3073,31 +3077,38 @@ var require_connection = __commonJS((exports, module) => {
             self.stream.end();
             return self.emit("error", new Error("There was an error establishing an SSL connection"));
         }
-        const options = {
-          socket: self.stream
-        };
-        if (self.ssl !== true) {
-          Object.assign(options, self.ssl);
-          if ("key" in self.ssl) {
-            options.key = self.ssl.key;
-          }
-        }
-        const net = __require("net");
-        if (net.isIP && net.isIP(host) === 0) {
-          options.servername = host;
-        }
-        try {
-          self.stream = getSecureStream(options);
-        } catch (err) {
-          return self.emit("error", err);
-        }
-        self.attachListeners(self.stream);
-        self.stream.on("error", reportStreamError);
-        self.emit("sslconnect");
+        self.upgradeToSSL(host, reportStreamError);
       });
     }
-    attachListeners(stream) {
-      parse(stream, (msg) => {
+    upgradeToSSL(host, reportStreamError) {
+      const self = this;
+      const options = {
+        socket: self.stream
+      };
+      if (self.ssl !== true) {
+        Object.assign(options, self.ssl);
+        if ("key" in self.ssl) {
+          options.key = self.ssl.key;
+        }
+      }
+      if (self.sslNegotiation === "direct") {
+        options.ALPNProtocols = ["postgresql"];
+      }
+      const net = __require("net");
+      if (net.isIP && net.isIP(host) === 0) {
+        options.servername = host;
+      }
+      try {
+        self.stream = stream.getSecureStream(options);
+      } catch (err) {
+        return self.emit("error", err);
+      }
+      self.attachListeners(self.stream);
+      self.stream.on("error", reportStreamError);
+      self.emit("sslconnect");
+    }
+    attachListeners(stream2) {
+      parse(stream2, (msg) => {
         const eventName = msg.name === "error" ? "errorMessage" : msg.name;
         if (this._emitMessage) {
           this.emit("message", msg);
@@ -3185,7 +3196,7 @@ var require_connection = __commonJS((exports, module) => {
   module.exports = Connection;
 });
 
-// node_modules/split2/index.js
+// node_modules/.pnpm/split2@4.2.0/node_modules/split2/index.js
 var require_split2 = __commonJS((exports, module) => {
   var { Transform } = __require("stream");
   var { StringDecoder } = __require("string_decoder");
@@ -3284,7 +3295,7 @@ var require_split2 = __commonJS((exports, module) => {
   module.exports = split;
 });
 
-// node_modules/pgpass/lib/helper.js
+// node_modules/.pnpm/pgpass@1.0.5/node_modules/pgpass/lib/helper.js
 var require_helper = __commonJS((exports, module) => {
   var path = __require("path");
   var Stream = __require("stream").Stream;
@@ -3448,7 +3459,7 @@ var require_helper = __commonJS((exports, module) => {
   };
 });
 
-// node_modules/pgpass/lib/index.js
+// node_modules/.pnpm/pgpass@1.0.5/node_modules/pgpass/lib/index.js
 var require_lib = __commonJS((exports, module) => {
   var path = __require("path");
   var fs = __require("fs");
@@ -3466,7 +3477,7 @@ var require_lib = __commonJS((exports, module) => {
   module.exports.warnTo = helper.warnTo;
 });
 
-// node_modules/pg/lib/client.js
+// node_modules/.pnpm/pg@8.22.0/node_modules/pg/lib/client.js
 var require_client = __commonJS((exports, module) => {
   var EventEmitter = __require("events").EventEmitter;
   var utils = require_utils();
@@ -3483,6 +3494,16 @@ var require_client = __commonJS((exports, module) => {
   var pgPassDeprecationNotice = nodeUtils.deprecate(() => {}, "pgpass support is deprecated and will be removed in pg@9.0. " + "You can provide an async function as the password property to the Client/Pool constructor that returns a password instead. Within this function you can call the pgpass module in your own code.");
   var byoPromiseDeprecationNotice = nodeUtils.deprecate(() => {}, "Passing a custom Promise implementation to the Client/Pool constructor is deprecated and will be removed in pg@9.0.");
   var queryQueueLengthDeprecationNotice = nodeUtils.deprecate(() => {}, "Calling client.query() when the client is already executing a query is deprecated and will be removed in pg@9.0. Use async/await or an external async flow control mechanism instead.");
+  function coerceNumberOrDefault(value, defaultValue) {
+    if (typeof value === "number") {
+      return Number.isFinite(value) ? value : defaultValue;
+    }
+    if (typeof value === "string" && value.trim() !== "") {
+      const n = Number(value);
+      return Number.isFinite(n) ? n : defaultValue;
+    }
+    return defaultValue;
+  }
 
   class Client extends EventEmitter {
     constructor(config) {
@@ -3512,10 +3533,13 @@ var require_client = __commonJS((exports, module) => {
       this._connectionError = false;
       this._queryable = true;
       this._activeQuery = null;
+      this._txStatus = null;
       this.enableChannelBinding = Boolean(c.enableChannelBinding);
+      this.scramMaxIterations = coerceNumberOrDefault(c.scramMaxIterations, sasl.DEFAULT_MAX_SCRAM_ITERATIONS);
       this.connection = c.connection || new Connection({
         stream: c.stream,
         ssl: this.connectionParameters.ssl,
+        sslNegotiation: this.connectionParameters.sslnegotiation,
         keepAlive: c.keepAlive || false,
         keepAliveInitialDelayMillis: c.keepAliveInitialDelayMillis || 0,
         encoding: this.connectionParameters.client_encoding || "utf8"
@@ -3525,6 +3549,7 @@ var require_client = __commonJS((exports, module) => {
       this.processID = null;
       this.secretKey = null;
       this.ssl = this.connectionParameters.ssl || false;
+      this.sslNegotiation = this.connectionParameters.sslnegotiation || "postgres";
       if (this.ssl && this.ssl.key) {
         Object.defineProperty(this.ssl, "key", {
           enumerable: false
@@ -3585,7 +3610,9 @@ var require_client = __commonJS((exports, module) => {
       }
       con.on("connect", function() {
         if (self.ssl) {
-          con.requestSsl();
+          if (self.sslNegotiation !== "direct") {
+            con.requestSsl();
+          }
         } else {
           con.startup(self.getStartupConf());
         }
@@ -3703,7 +3730,7 @@ var require_client = __commonJS((exports, module) => {
     _handleAuthSASL(msg) {
       this._getPassword(() => {
         try {
-          this.saslSession = sasl.startSession(msg.mechanisms, this.enableChannelBinding && this.connection.stream);
+          this.saslSession = sasl.startSession(msg.mechanisms, this.enableChannelBinding && this.connection.stream, this.scramMaxIterations);
           this.connection.sendSASLInitialResponseMessage(this.saslSession.mechanism, this.saslSession.response);
         } catch (err) {
           this.connection.emit("error", err);
@@ -3743,6 +3770,7 @@ var require_client = __commonJS((exports, module) => {
       }
       const activeQuery = this._getActiveQuery();
       this._activeQuery = null;
+      this._txStatus = msg?.status ?? null;
       this.readyForQuery = true;
       if (activeQuery) {
         activeQuery.handleReadyForQuery(this.connection);
@@ -3938,13 +3966,10 @@ var require_client = __commonJS((exports, module) => {
     query(config, values, callback) {
       let query;
       let result;
-      let readTimeout;
-      let readTimeoutTimer;
-      let queryCallback;
-      if (config === null || config === undefined) {
+      if (config == null) {
         throw new TypeError("Client was passed a null or undefined query");
-      } else if (typeof config.submit === "function") {
-        readTimeout = config.query_timeout || this.connectionParameters.query_timeout;
+      }
+      if (typeof config.submit === "function") {
         result = query = config;
         if (!query.callback) {
           if (typeof values === "function") {
@@ -3954,7 +3979,6 @@ var require_client = __commonJS((exports, module) => {
           }
         }
       } else {
-        readTimeout = config.query_timeout || this.connectionParameters.query_timeout;
         query = new Query(config, values, callback);
         if (!query.callback) {
           result = new this._Promise((resolve2, reject) => {
@@ -3963,11 +3987,14 @@ var require_client = __commonJS((exports, module) => {
             Error.captureStackTrace(err);
             throw err;
           });
+        } else if (typeof query.callback !== "function") {
+          throw new TypeError("callback is not a function");
         }
       }
+      const readTimeout = config.query_timeout || this.connectionParameters.query_timeout;
       if (readTimeout) {
-        queryCallback = query.callback || (() => {});
-        readTimeoutTimer = setTimeout(() => {
+        const queryCallback = query.callback || (() => {});
+        const readTimeoutTimer = setTimeout(() => {
           const error = new Error("Query read timeout");
           process.nextTick(() => {
             query.handleError(error, this.connection);
@@ -4016,11 +4043,15 @@ var require_client = __commonJS((exports, module) => {
     unref() {
       this.connection.unref();
     }
+    getTransactionStatus() {
+      return this._txStatus;
+    }
     end(cb) {
       this._ending = true;
       if (!this.connection._connecting || this._ended) {
         if (cb) {
           cb();
+          return;
         } else {
           return this._Promise.resolve();
         }
@@ -4047,7 +4078,7 @@ var require_client = __commonJS((exports, module) => {
   module.exports = Client;
 });
 
-// node_modules/pg-pool/index.js
+// node_modules/.pnpm/pg-pool@3.14.0_pg@8.22.0/node_modules/pg-pool/index.js
 var require_pg_pool = __commonJS((exports, module) => {
   var EventEmitter = __require("events").EventEmitter;
   var NOOP = function() {};
@@ -4459,7 +4490,7 @@ var require_pg_pool = __commonJS((exports, module) => {
   module.exports = Pool;
 });
 
-// node_modules/pg/lib/native/query.js
+// node_modules/.pnpm/pg@8.22.0/node_modules/pg/lib/native/query.js
 var require_query2 = __commonJS((exports, module) => {
   var EventEmitter = __require("events").EventEmitter;
   var util = __require("util");
@@ -4595,7 +4626,7 @@ var require_query2 = __commonJS((exports, module) => {
   };
 });
 
-// node_modules/pg/lib/native/client.js
+// node_modules/.pnpm/pg@8.22.0/node_modules/pg/lib/native/client.js
 var require_client2 = __commonJS((exports, module) => {
   var nodeUtils = __require("util");
   var Native;
@@ -4777,8 +4808,10 @@ var require_client2 = __commonJS((exports, module) => {
   Client.prototype.end = function(cb) {
     const self = this;
     this._ending = true;
-    if (!this._connected) {
-      this.once("connect", this.end.bind(this, cb));
+    if (this._connecting && !this._connected) {
+      this.once("connect", () => {
+        this.end(() => {});
+      });
     }
     let result;
     if (!cb) {
@@ -4839,9 +4872,12 @@ var require_client2 = __commonJS((exports, module) => {
   Client.prototype.isConnected = function() {
     return this._connected;
   };
+  Client.prototype.getTransactionStatus = function() {
+    return this.native.getTransactionStatus();
+  };
 });
 
-// node_modules/pg/lib/index.js
+// node_modules/.pnpm/pg@8.22.0/node_modules/pg/lib/index.js
 var require_lib2 = __commonJS((exports, module) => {
   var Client = require_client();
   var defaults = require_defaults();
@@ -4907,7 +4943,7 @@ var require_lib2 = __commonJS((exports, module) => {
 var require_package = __commonJS((exports, module) => {
   module.exports = {
     name: "@hasna/shortlinks",
-    version: "0.2.0",
+    version: "0.2.2",
     description: "Shortlink manager for custom domains and click tracking, with local SQLite or self-hosted cloud (/v1 API + bearer key) storage and Cloudflare setup helpers",
     type: "module",
     main: "dist/index.js",
@@ -4948,7 +4984,7 @@ var require_package = __commonJS((exports, module) => {
       "SECURITY.md"
     ],
     scripts: {
-      build: "rm -rf dist && bun build src/cli/index.ts src/mcp/index.ts src/serve/index.ts src/sdk/index.ts src/index.ts src/server.ts src/cloudflare.ts src/pg-store.ts --root src --outdir dist --target bun --external @modelcontextprotocol/sdk --external @hasna/mcp-harness --external @hasna/mcp-harness/node && tsc -p tsconfig.build.json --emitDeclarationOnly --outDir dist",
+      build: "rm -rf dist && bun build src/cli/index.ts src/mcp/index.ts src/serve/index.ts src/sdk/index.ts src/index.ts src/server.ts src/cloudflare.ts src/pg-store.ts --root src --outdir dist --target bun --external @modelcontextprotocol/sdk && tsc -p tsconfig.build.json --emitDeclarationOnly --outDir dist",
       "sdk:generate": "bun run scripts/generate-sdk.ts",
       typecheck: "tsc --noEmit",
       test: "bun test",
@@ -4988,7 +5024,6 @@ var require_package = __commonJS((exports, module) => {
     license: "Apache-2.0",
     dependencies: {
       "@hasna/events": "^0.1.6",
-      "@hasna/mcp-harness": "file:../open-mcp",
       "@modelcontextprotocol/sdk": "^1.27.1",
       chalk: "^5.4.1",
       commander: "^13.1.0",
@@ -4996,7 +5031,7 @@ var require_package = __commonJS((exports, module) => {
       pg: "^8.13.3"
     },
     devDependencies: {
-      "@hasna/contracts": "file:../open-contracts",
+      "@hasna/contracts": "^0.5.2",
       "@types/pg": "^8.11.11",
       "@types/bun": "^1.2.4",
       typescript: "^5.7.3"
@@ -5446,6 +5481,13 @@ class PgShortlinksStore {
     `);
     return row ? domainFromRow(row) : null;
   }
+  async deleteDomain(hostnameOrId) {
+    const domain = await this.getDomain(hostnameOrId);
+    if (!domain)
+      throw new Error("Domain not found.");
+    await this.pg.run("DELETE FROM domains WHERE id = ?", domain.id);
+    return domain;
+  }
   async createLink(input) {
     const domain = input.domain ? await this.getDomain(input.domain) : await this.getDefaultDomain();
     if (!domain) {
@@ -5622,7 +5664,7 @@ class PgShortlinksStore {
   }
 }
 
-// node_modules/pg/esm/index.mjs
+// node_modules/.pnpm/pg@8.22.0/node_modules/pg/esm/index.mjs
 var import_lib = __toESM(require_lib2(), 1);
 var Client = import_lib.default.Client;
 var Pool = import_lib.default.Pool;
@@ -5945,7 +5987,7 @@ class MigrationLedger {
   }
 }
 
-// ../open-contracts/dist/auth/index.js
+// node_modules/.pnpm/@hasna+contracts@0.5.2/node_modules/@hasna/contracts/dist/auth/index.js
 import { createHash as createHash3, createHmac, randomBytes as randomBytes3, timingSafeEqual } from "crypto";
 var API_KEY_TOKEN_VERSION = 1;
 var API_KEY_NAMESPACE = "hasna";
@@ -8066,6 +8108,11 @@ function buildOpenApiDocument(version) {
           properties: { deleted: { type: "boolean" }, slug: { type: "string" } },
           required: ["deleted"]
         },
+        DomainDeleteResponse: {
+          type: "object",
+          properties: { deleted: { type: "boolean" }, hostname: { type: "string" } },
+          required: ["deleted"]
+        },
         HealthStatus: probe({ db_latency_ms: { type: "integer" } }),
         ReadyStatus: probe({ pending_migrations: { type: "array", items: { type: "string" } } }),
         VersionInfo: probe({ name: { type: "string" } }),
@@ -8136,6 +8183,19 @@ function buildOpenApiDocument(version) {
           }
         }
       },
+      "/v1/domains/{hostname}": {
+        delete: {
+          operationId: "deleteDomain",
+          summary: "Delete a domain and all of its links and clicks.",
+          security: [{ apiKey: [] }],
+          parameters: [
+            { name: "hostname", in: "path", required: true, schema: { type: "string" } }
+          ],
+          responses: {
+            "200": { content: { "application/json": { schema: { $ref: "#/components/schemas/DomainDeleteResponse" } } } }
+          }
+        }
+      },
       "/v1/links": {
         get: {
           operationId: "listLinks",
@@ -8337,6 +8397,18 @@ function createServeApp(deps) {
       return handleError(c, error);
     }
   });
+  app.delete("/v1/domains/:hostname", async (c) => {
+    const denied = await requireScopes(c, [`${APP_SLUG}:write`]);
+    if (denied)
+      return denied;
+    const hostname2 = c.req.param("hostname");
+    try {
+      const domain = await store.deleteDomain(hostname2);
+      return c.json({ deleted: true, hostname: domain.hostname });
+    } catch (error) {
+      return handleError(c, error);
+    }
+  });
   app.get("/v1/links", async (c) => {
     const denied = await requireScopes(c, [`${APP_SLUG}:read`]);
     if (denied)