@nextsparkjs/core 0.1.0-beta.196 → 0.1.0-beta.197

package/dist/lib/db-pool.d.ts

@@ -0,0 +1,31 @@
+import { Pool, type PoolConfig } from 'pg';
+/**
+ * The one place core's runtime pg pools get their resilience options, so the app pool, the service pool and the
+ * Better Auth pool cannot drift. Idle connections on Neon, Supabase poolers and behind NAT/load balancers are dropped
+ * silently; without these options the next query waits for the OS TCP timeout (minutes) on a dead socket, and the
+ * socket error on an idle client surfaces as an `uncaughtException`.
+ */
+/** Far below the idle cutoffs seen in practice (Azure LB 4 min, AWS NLB 350 s, NAT tables 60 s and up): an idle client is closed by us long before a provider drops it, at the cost of an occasional reconnect. */
+export declare const POOL_IDLE_TIMEOUT_MS = 10000;
+export declare const POOL_CONNECTION_TIMEOUT_MS = 10000;
+/** First TCP keep-alive probe 10 s after the socket goes quiet; how soon a dead peer is detected after that depends on the OS. */
+export declare const POOL_KEEP_ALIVE_DELAY_MS = 10000;
+/** Default for DB_QUERY_TIMEOUT_MS: long enough for a heavy report, short of the minutes a dead socket takes to fail. */
+export declare const DEFAULT_QUERY_TIMEOUT_MS = 60000;
+/**
+ * A timeout in milliseconds from the environment. Unset or empty gives `fallback`; `0` gives `undefined` (no limit);
+ * anything that is not a non-negative integer warns once and gives `fallback`.
+ */
+export declare function parseTimeoutMs(name: string, raw: string | undefined, fallback: number | undefined): number | undefined;
+/**
+ * DB_QUERY_TIMEOUT_MS (default 60000): the client gives up on a query that has no answer after this long. It works on
+ * every provider, pooled or not, and is what fails a query on a dead socket. 0 disables it.
+ * DB_STATEMENT_TIMEOUT_MS (default unset): also asks the server to cancel a statement after this long. Opt-in because
+ * the limit travels as a connection startup parameter, which some transaction poolers (PgBouncer) reject.
+ */
+export declare function poolTimeouts(env?: NodeJS.ProcessEnv): Pick<PoolConfig, 'query_timeout' | 'statement_timeout'>;
+/** What is safe to log about a pool error: its code or class, never the message (it can carry hosts, users or databases). */
+export declare function describePoolError(err: unknown): string;
+/** A Pool with core's keep-alive, timeouts and error handling on top of `config`; `label` says which pool in the log. */
+export declare function createPool(label: string, config: PoolConfig): Pool;
+//# sourceMappingURL=db-pool.d.ts.map

package/dist/lib/db-pool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-pool.d.ts","sourceRoot":"","sources":["../../src/lib/db-pool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAmB,KAAK,UAAU,EAAE,MAAM,IAAI,CAAC;AAE5D;;;;;GAKG;AAEH,mNAAmN;AACnN,eAAO,MAAM,oBAAoB,QAAS,CAAC;AAC3C,eAAO,MAAM,0BAA0B,QAAS,CAAC;AACjD,kIAAkI;AAClI,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAC/C,yHAAyH;AACzH,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAE/C;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAQtH;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,IAAI,CAAC,UAAU,EAAE,eAAe,GAAG,mBAAmB,CAAC,CAK1H;AAED,6HAA6H;AAC7H,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAGtD;AA8BD,yHAAyH;AACzH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CAmBlE"}

package/dist/lib/db-pool.js

@@ -0,0 +1,75 @@
+import { Pool } from "pg";
+const POOL_IDLE_TIMEOUT_MS = 1e4;
+const POOL_CONNECTION_TIMEOUT_MS = 1e4;
+const POOL_KEEP_ALIVE_DELAY_MS = 1e4;
+const DEFAULT_QUERY_TIMEOUT_MS = 6e4;
+function parseTimeoutMs(name, raw, fallback) {
+  if (raw === void 0 || raw.trim() === "") return fallback;
+  const value = Number(raw);
+  if (!Number.isInteger(value) || value < 0) {
+    console.warn(`[DB] Ignoring ${name}="${raw}": expected a non-negative integer of milliseconds (0 disables).`);
+    return fallback;
+  }
+  return value === 0 ? void 0 : value;
+}
+function poolTimeouts(env = process.env) {
+  return {
+    query_timeout: parseTimeoutMs("DB_QUERY_TIMEOUT_MS", env.DB_QUERY_TIMEOUT_MS, DEFAULT_QUERY_TIMEOUT_MS),
+    statement_timeout: parseTimeoutMs("DB_STATEMENT_TIMEOUT_MS", env.DB_STATEMENT_TIMEOUT_MS, void 0)
+  };
+}
+function describePoolError(err) {
+  const e = err;
+  return String((e == null ? void 0 : e.code) ?? (e == null ? void 0 : e.name) ?? "unknown");
+}
+const QUERY_TIMEOUT_MESSAGE = "Query read timeout";
+function dropOnQueryTimeout(client) {
+  const query = client.query.bind(client);
+  const drop = (err) => {
+    var _a, _b;
+    if ((err == null ? void 0 : err.message) === QUERY_TIMEOUT_MESSAGE) {
+      client._queryable = false;
+      (_b = (_a = client.connection) == null ? void 0 : _a.stream) == null ? void 0 : _b.destroy();
+    }
+  };
+  client.query = (...args) => {
+    const last = args[args.length - 1];
+    if (typeof last === "function") {
+      args[args.length - 1] = (err, ...rest) => {
+        drop(err);
+        last(err, ...rest);
+      };
+    }
+    const result = query(...args);
+    if (typeof (result == null ? void 0 : result.catch) === "function") result.catch(drop);
+    return result;
+  };
+}
+function createPool(label, config) {
+  const pool = new Pool({
+    max: 20,
+    idleTimeoutMillis: POOL_IDLE_TIMEOUT_MS,
+    connectionTimeoutMillis: POOL_CONNECTION_TIMEOUT_MS,
+    keepAlive: true,
+    keepAliveInitialDelayMillis: POOL_KEEP_ALIVE_DELAY_MS,
+    ...poolTimeouts(),
+    ...config
+  });
+  pool.on("connect", (client) => {
+    dropOnQueryTimeout(client);
+    client.on("error", (err) => console.warn(`[DB] ${label} pool: client error (${describePoolError(err)}); connection dropped.`));
+  });
+  pool.on("error", () => {
+  });
+  return pool;
+}
+export {
+  DEFAULT_QUERY_TIMEOUT_MS,
+  POOL_CONNECTION_TIMEOUT_MS,
+  POOL_IDLE_TIMEOUT_MS,
+  POOL_KEEP_ALIVE_DELAY_MS,
+  createPool,
+  describePoolError,
+  parseTimeoutMs,
+  poolTimeouts
+};

package/dist/lib/db.d.ts

@@ -1,4 +1,4 @@
-import { Pool } from 'pg';
+import type { Pool } from 'pg';
 /**
  * Strip SSL-related parameters from DATABASE_URL to prevent pg-connection-string
  * from overriding our explicit ssl config.

package/dist/lib/db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/lib/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAmB,MAAM,IAAI,CAAC;AAQ3C;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAe1D;AAiBD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,KAAK,GAAG;IAAE,kBAAkB,EAAE,OAAO,CAAA;CAAE,CA+C3F;AAQD,QAAA,MAAM,IAAI,MAMR,CAAC;AAoBH,QAAA,MAAM,WAAW,EAAE,IASX,CAAC;AAET;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAuBnD;AAgCD,MAAM,WAAW,UAAU;IACzB,wEAAwE;IACxE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAWD;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAAC,CAAC,GAAG,OAAO,EAC5C,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,OAAO,EAAO,EACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,EACtB,OAAO,CAAC,EAAE,UAAU,GACnB,OAAO,CAAC,CAAC,EAAE,CAAC,CAiCd;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,CAAC,GAAG,OAAO,EAC/C,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,OAAO,EAAO,EACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,EACtB,OAAO,CAAC,EAAE,UAAU,GACnB,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAGnB;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,CAAC,GAAG,OAAO,EAC7C,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,OAAO,EAAO,EACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,EACtB,OAAO,CAAC,EAAE,UAAU,GACnB,OAAO,CAAC;IAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CA6B1C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,CAAC,EAAE,UAAU;YAsB3E,CAAC,mBAAmB,MAAM,WAAU,OAAO,EAAE;eAE1C,CAAC,mBAAmB,MAAM,WAAU,OAAO,EAAE;aAE/C,CAAC,mBAAmB,MAAM,WAAU,OAAO,EAAE;cACK,CAAC,EAAE;;;;;GAUjE;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B;YAzB/B,CAAC,mBAAmB,MAAM,WAAU,OAAO,EAAE;eAE1C,CAAC,mBAAmB,MAAM,WAAU,OAAO,EAAE;aAE/C,CAAC,mBAAmB,MAAM,WAAU,OAAO,EAAE;cACK,CAAC,EAAE;;;;;GAsBjE;AAGD;;;;;;;GAOG;AACH,wBAAsB,KAAK,CAAC,CAAC,GAAG,OAAO,EACrC,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,OAAO,EAAE,GACjB,OAAO,CAAC;IAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAQ1C;AAED;;;GAGG;AACH,wBAAsB,SAAS,CAAC,CAAC,GAAG,OAAO,EACzC,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,OAAO,EAAE,GACjB,OAAO,CAAC,CAAC,EAAE,CAAC,CAGd;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,CAAC,GAAG,OAAO,EACxC,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,OAAO,EAAE,GACjB,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAGnB;AAID,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AAE7B;;;;;GAKG;AACH,wBAAgB,OAAO,IAAI,IAAI,CAK9B;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,IAAI,OAAO,CAuBvC;AAED;;GAEG;AACH,wBAAgB,YAAY;;;;;;EAQ3B;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,SAAS,GAAE,MAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAqD/E;AAgBD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAYrF;AAMD,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,OAAO,CAAC,CAchE"}
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/lib/db.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,IAAI,CAAC;AAS3C;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAe1D;AAiBD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,KAAK,GAAG;IAAE,kBAAkB,EAAE,OAAO,CAAA;CAAE,CA+C3F;AAQD,QAAA,MAAM,IAAI,MAGR,CAAC;AAoBH,QAAA,MAAM,WAAW,EAAE,IAMX,CAAC;AAET;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAuBnD;AAgCD,MAAM,WAAW,UAAU;IACzB,wEAAwE;IACxE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAWD;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAAC,CAAC,GAAG,OAAO,EAC5C,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,OAAO,EAAO,EACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,EACtB,OAAO,CAAC,EAAE,UAAU,GACnB,OAAO,CAAC,CAAC,EAAE,CAAC,CAiCd;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,CAAC,GAAG,OAAO,EAC/C,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,OAAO,EAAO,EACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,EACtB,OAAO,CAAC,EAAE,UAAU,GACnB,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAGnB;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,CAAC,GAAG,OAAO,EAC7C,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,OAAO,EAAO,EACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,EACtB,OAAO,CAAC,EAAE,UAAU,GACnB,OAAO,CAAC;IAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CA6B1C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,CAAC,EAAE,UAAU;YAsB3E,CAAC,mBAAmB,MAAM,WAAU,OAAO,EAAE;eAE1C,CAAC,mBAAmB,MAAM,WAAU,OAAO,EAAE;aAE/C,CAAC,mBAAmB,MAAM,WAAU,OAAO,EAAE;cACK,CAAC,EAAE;;;;;GAUjE;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B;YAzB/B,CAAC,mBAAmB,MAAM,WAAU,OAAO,EAAE;eAE1C,CAAC,mBAAmB,MAAM,WAAU,OAAO,EAAE;aAE/C,CAAC,mBAAmB,MAAM,WAAU,OAAO,EAAE;cACK,CAAC,EAAE;;;;;GAsBjE;AAGD;;;;;;;GAOG;AACH,wBAAsB,KAAK,CAAC,CAAC,GAAG,OAAO,EACrC,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,OAAO,EAAE,GACjB,OAAO,CAAC;IAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAQ1C;AAED;;;GAGG;AACH,wBAAsB,SAAS,CAAC,CAAC,GAAG,OAAO,EACzC,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,OAAO,EAAE,GACjB,OAAO,CAAC,CAAC,EAAE,CAAC,CAGd;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,CAAC,GAAG,OAAO,EACxC,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,OAAO,EAAE,GACjB,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAGnB;AAID,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AAE7B;;;;;GAKG;AACH,wBAAgB,OAAO,IAAI,IAAI,CAK9B;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,IAAI,OAAO,CAuBvC;AAED;;GAEG;AACH,wBAAgB,YAAY;;;;;;EAQ3B;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,SAAS,GAAE,MAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAqD/E;AAgBD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAYrF;AAMD,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,OAAO,CAAC,CAchE"}

package/dist/lib/db.js

@@ -1,4 +1,4 @@
-import { Pool } from "pg";
+import { createPool } from "./db-pool.js";
 import { isValidUUID } from "./utils/uuid.js";
 let activeConnections = 0;
 let isShuttingDown = false;
@@ -57,20 +57,14 @@ function parseSSLConfig(databaseUrl2) {
 }
 const databaseUrl = process.env.DATABASE_URL || "";
 const sslConfig = parseSSLConfig(databaseUrl);
-const pool = new Pool({
+const pool = createPool("app", {
   connectionString: stripSSLParams(databaseUrl),
-  ssl: sslConfig,
-  max: 20,
-  idleTimeoutMillis: 3e4,
-  connectionTimeoutMillis: 1e4
+  ssl: sslConfig
 });
 const serviceDatabaseUrl = process.env.DATABASE_SERVICE_URL || databaseUrl;
-const servicePool = serviceDatabaseUrl === databaseUrl ? pool : new Pool({
+const servicePool = serviceDatabaseUrl === databaseUrl ? pool : createPool("service", {
   connectionString: stripSSLParams(serviceDatabaseUrl),
-  ssl: parseSSLConfig(serviceDatabaseUrl),
-  max: 20,
-  idleTimeoutMillis: 3e4,
-  connectionTimeoutMillis: 1e4
+  ssl: parseSSLConfig(serviceDatabaseUrl)
 });
 function validateUserId(userId) {
   const isProduction = process.env.NODE_ENV === "production";
@@ -115,7 +109,8 @@ async function queryWithRLS(query2, params = [], userId, options) {
     await client.query("COMMIT");
     return result.rows;
   } catch (error) {
-    await client.query("ROLLBACK");
+    await client.query("ROLLBACK").catch(() => {
+    });
     throw error;
   } finally {
     releaseClient(client);
@@ -141,7 +136,8 @@ async function mutateWithRLS(query2, params = [], userId, options) {
       rowCount: result.rowCount || 0
     };
   } catch (error) {
-    await client.query("ROLLBACK");
+    await client.query("ROLLBACK").catch(() => {
+    });
     throw error;
   } finally {
     releaseClient(client);
@@ -169,7 +165,8 @@ async function getTransactionClient(userId, options) {
       releaseClient(client);
     },
     rollback: async () => {
-      await client.query("ROLLBACK");
+      await client.query("ROLLBACK").catch(() => {
+      });
       releaseClient(client);
     }
   };

package/dist/lib/entities/api-generator.js

@@ -2,7 +2,7 @@ import { NextResponse } from "next/server";
 import * as z from "zod";
 import { getEntityConfig } from "./registry.js";
 import { executeEntityHooks } from "./hooks.js";
-import { getTypedSession } from "../auth.js";
+import { getAuthorizationSession } from "../auth/authorization-session.js";
 function generateEntityAPI(entityName, options = {}) {
   const entityConfig = getEntityConfig(entityName);
   if (!entityConfig) {
@@ -27,7 +27,7 @@ function createGETHandler(entityConfig, options) {
     try {
       let user = null;
       if (options.enableAuth) {
-        const session = await getTypedSession(request.headers);
+        const session = await getAuthorizationSession(request.headers);
         if (!session) {
           return NextResponse.json({ error: "Authentication required" }, { status: 401 });
         }
@@ -78,7 +78,7 @@ function createPOSTHandler(entityConfig, options) {
     try {
       let user = null;
       if (options.enableAuth) {
-        const session = await getTypedSession(request.headers);
+        const session = await getAuthorizationSession(request.headers);
         if (!session) {
           return NextResponse.json({ error: "Authentication required" }, { status: 401 });
         }
@@ -126,7 +126,7 @@ function createPATCHHandler(entityConfig, options) {
     try {
       let user = null;
       if (options.enableAuth) {
-        const session = await getTypedSession(request.headers);
+        const session = await getAuthorizationSession(request.headers);
         if (!session) {
           return NextResponse.json({ error: "Authentication required" }, { status: 401 });
         }
@@ -205,7 +205,7 @@ function createDELETEHandler(entityConfig, options) {
     try {
       let user = null;
       if (options.enableAuth) {
-        const session = await getTypedSession(request.headers);
+        const session = await getAuthorizationSession(request.headers);
         if (!session) {
           return NextResponse.json({ error: "Authentication required" }, { status: 401 });
         }

package/dist/lib/oauth/token-refresh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token-refresh.d.ts","sourceRoot":"","sources":["../../../src/lib/oauth/token-refresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,EACL,aAAa,EAEb,kBAAkB,EAKnB,MAAM,SAAS,CAAC;AAuCjB;;GAEG;AACH,qBAAa,mBAAmB;IAC9B;;;;;OAKG;IACH,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO;IAahE;;;;;;;;OAQG;WACU,YAAY,CACvB,QAAQ,EAAE,aAAa,EACvB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,kBAAkB,CAAC;IAoC9B;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,kBAAkB;IA2BjC;;;;;OAKG;WACU,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAkHtE;;;;;OAKG;WACU,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA+B/D;;;;OAIG;WACU,uBAAuB,IAAI,OAAO,CAAC,MAAM,CAAC;IAqCvD;;OAEG;mBACkB,iBAAiB;IAetC;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,WAAW;IAa1B;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,eAAe;IAa9B;;;;;OAKG;WACU,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAmC/D;;OAEG;mBACkB,uBAAuB;CAuB7C"}
+{"version":3,"file":"token-refresh.d.ts","sourceRoot":"","sources":["../../../src/lib/oauth/token-refresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,EACL,aAAa,EAEb,kBAAkB,EAKnB,MAAM,SAAS,CAAC;AAoCjB;;GAEG;AACH,qBAAa,mBAAmB;IAC9B;;;;;OAKG;IACH,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO;IAahE;;;;;;;;OAQG;WACU,YAAY,CACvB,QAAQ,EAAE,aAAa,EACvB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,kBAAkB,CAAC;IAoC9B;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,kBAAkB;IA2BjC;;;;;OAKG;WACU,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAkHtE;;;;;OAKG;WACU,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA+B/D;;;;OAIG;WACU,uBAAuB,IAAI,OAAO,CAAC,MAAM,CAAC;IAqCvD;;OAEG;mBACkB,iBAAiB;IAetC;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,WAAW;IAa1B;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,eAAe;IAa9B;;;;;OAKG;WACU,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAmC/D;;OAEG;mBACkB,uBAAuB;CAuB7C"}

package/dist/lib/oauth/token-refresh.js

@@ -1,4 +1,4 @@
-import { Pool } from "pg";
+import { createPool } from "../db-pool.js";
 import { parseSSLConfig } from "../db.js";
 import { TokenEncryption } from "./encryption.js";
 import {
@@ -20,12 +20,9 @@ const REFRESH_CONFIG = {
 };
 const databaseUrl = process.env.DATABASE_URL;
 const connectionString = databaseUrl.includes("?") ? `${databaseUrl}&pgbouncer=true` : `${databaseUrl}?pgbouncer=true`;
-const pool = new Pool({
+const pool = createPool("oauth-token-refresh", {
   connectionString,
-  ssl: parseSSLConfig(databaseUrl),
-  connectionTimeoutMillis: 1e4,
-  idleTimeoutMillis: 3e4,
-  max: 20
+  ssl: parseSSLConfig(databaseUrl)
 });
 class TokenRefreshService {
   /**

package/dist/lib/permissions/check.d.ts

@@ -79,4 +79,13 @@ export declare function getUserPermissions(userId: string, teamId: string): Prom
  * ```
  */
 export declare function hasPermissionSync(teamRole: TeamRole, permission: Permission): boolean;
+/**
+ * The extra permission a write needs when it moves a record into or out of `published`: `<slug>.publish`, if the
+ * entity declares that action, else null. `next` is the status the write sets (undefined: not changed) and
+ * `current` the stored one (undefined on create). Every writer asks this: the REST handler (and the page builder
+ * through it), GenericEntityService and the server actions through it.
+ */
+export declare function publishPermissionFor(entitySlug: string, next: unknown, current?: unknown): Permission | null;
+/** `<slug>.publish` when the entity declares that action, else null. */
+export declare function declaredPublishPermission(entitySlug: string): Permission | null;
 //# sourceMappingURL=check.d.ts.map

package/dist/lib/permissions/check.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../../src/lib/permissions/check.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAuBnD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,OAAO,CAAC,CAuBlB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,UAAU,EAAE,GACxB,OAAO,CAAC,OAAO,CAAC,CAOlB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,UAAU,EAAE,GACxB,OAAO,CAAC,OAAO,CAAC,CAOlB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,UAAU,EAAE,CAAC,CAQvB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,QAAQ,EAClB,UAAU,EAAE,UAAU,GACrB,OAAO,CAET"}
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../../src/lib/permissions/check.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAuBnD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,OAAO,CAAC,CAuBlB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,UAAU,EAAE,GACxB,OAAO,CAAC,OAAO,CAAC,CAOlB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,UAAU,EAAE,GACxB,OAAO,CAAC,OAAO,CAAC,CAOlB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,UAAU,EAAE,CAAC,CAQvB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,QAAQ,EAClB,UAAU,EAAE,UAAU,GACrB,OAAO,CAET;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,UAAU,GAAG,IAAI,CAG5G;AAED,wEAAwE;AACxE,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAG/E"}

package/dist/lib/permissions/check.js

@@ -52,10 +52,20 @@ async function getUserPermissions(userId, teamId) {
 function hasPermissionSync(teamRole, permission) {
   return permissionRegistry.hasPermission(teamRole, permission);
 }
+function publishPermissionFor(entitySlug, next, current) {
+  if (next === void 0 || next === "published" === (current === "published")) return null;
+  return declaredPublishPermission(entitySlug);
+}
+function declaredPublishPermission(entitySlug) {
+  const permission = `${entitySlug}.publish`;
+  return permissionRegistry.isValidPermission(permission) ? permission : null;
+}
 export {
   checkAnyPermission,
   checkPermission,
   checkPermissions,
+  declaredPublishPermission,
   getUserPermissions,
-  hasPermissionSync
+  hasPermissionSync,
+  publishPermissionFor
 };

package/dist/lib/services/generic-entity.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generic-entity.service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/generic-entity.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAaH,OAAO,KAAK,EAAE,YAAY,EAAe,MAAM,mBAAmB,CAAA;AAMlE,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,iBAAiB,CAAC,CAAC;IAClC,IAAI,EAAE,CAAC,EAAE,CAAA;IACT,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;CACf;AAiBD,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,OAAO,CAAA;IACd,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB;AA8MD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,YAAY,EAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,QAAQ,GAAE,OAAe,GACxB,gBAAgB,CAuClB;AAMD,qBAAa,oBAAoB;IAC/B;;;;;;;;OAQG;WACU,OAAO,CAAC,CAAC,GAAG,OAAO,EAC9B,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAgCpB;;;;;;;OAOG;WACU,IAAI,CAAC,CAAC,GAAG,OAAO,EAC3B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;IAiFhC;;;;;;;;OAQG;WACU,MAAM,CAAC,CAAC,GAAG,OAAO,EAC7B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,OAAO,CAAC,CAAC,CAAC;IAiEb;;;;;;;;;OASG;WACU,MAAM,CAAC,CAAC,GAAG,OAAO,EAC7B,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,CAAC,CAAC;IAiGb;;;;;;;;OAQG;WACU,MAAM,CACjB,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,OAAO,CAAC;IA0DnB;;;;;;;;OAQG;WACU,MAAM,CACjB,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,OAAO,CAAC;IA2BnB;;;;;;;OAOG;WACU,KAAK,CAChB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAClC,OAAO,CAAC,MAAM,CAAC;IA0BlB;;;;;;;;;;;;;;;;OAgBG;WACU,UAAU,CACrB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,EAAE,EACb,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO,GACxD,OAAO,CAAC,MAAM,CAAC;CA0CnB"}
+{"version":3,"file":"generic-entity.service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/generic-entity.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAaH,OAAO,KAAK,EAAE,YAAY,EAAe,MAAM,mBAAmB,CAAA;AAOlE,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,iBAAiB,CAAC,CAAC;IAClC,IAAI,EAAE,CAAC,EAAE,CAAA;IACT,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;CACf;AAiBD,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,OAAO,CAAA;IACd,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB;AA8MD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,YAAY,EAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,QAAQ,GAAE,OAAe,GACxB,gBAAgB,CAuClB;AAMD,qBAAa,oBAAoB;IAC/B;;;;;;;;OAQG;WACU,OAAO,CAAC,CAAC,GAAG,OAAO,EAC9B,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAgCpB;;;;;;;OAOG;WACU,IAAI,CAAC,CAAC,GAAG,OAAO,EAC3B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;IAiFhC;;;;;;;;OAQG;WACU,MAAM,CAAC,CAAC,GAAG,OAAO,EAC7B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,OAAO,CAAC,CAAC,CAAC;IA2Fb;;;;;;;;;OASG;WACU,MAAM,CAAC,CAAC,GAAG,OAAO,EAC7B,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,CAAC,CAAC;IA6Gb;;;;;;;;OAQG;WACU,MAAM,CACjB,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,OAAO,CAAC;IA0DnB;;;;;;;;OAQG;WACU,MAAM,CACjB,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,OAAO,CAAC;IA2BnB;;;;;;;OAOG;WACU,KAAK,CAChB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAClC,OAAO,CAAC,MAAM,CAAC;IA0BlB;;;;;;;;;;;;;;;;OAgBG;WACU,UAAU,CACrB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,EAAE,EACb,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO,GACxD,OAAO,CAAC,MAAM,CAAC;CA0CnB"}

package/dist/lib/services/generic-entity.service.js

@@ -1,4 +1,4 @@
-import { queryWithRLS, queryOneWithRLS, mutateWithRLS } from "../db.js";
+import { queryWithRLS, queryOneWithRLS, mutateWithRLS, getTransactionClient } from "../db.js";
 import { entityRegistry } from "../entities/registry.js";
 import { expirePublicEntity } from "../cache/public-entity-cache.js";
 import {
@@ -9,6 +9,7 @@ import {
   beforeEntityDelete,
   afterEntityDelete
 } from "../entities/entity-hooks.js";
+import { checkPermission, declaredPublishPermission, publishPermissionFor } from "../permissions/check.js";
 const SYSTEM_FIELDS = ["id", "userId", "teamId", "createdAt", "updatedAt"];
 const DEFAULT_LIMIT = 20;
 const DEFAULT_ORDER_BY = "createdAt";
@@ -296,6 +297,7 @@ class GenericEntityService {
    * @returns Created entity
    */
   static async create(entitySlug, userId, teamId, data) {
+    var _a;
     if (!(userId == null ? void 0 : userId.trim())) {
       throw new Error("User ID is required");
     }
@@ -311,6 +313,13 @@ class GenericEntityService {
     if (!validation.valid) {
       throw new Error(`Validation failed: ${validation.errors.join(", ")}`);
     }
+    const statusField = entityConfig.fields.find((f) => f.name === "status");
+    const createStatus = finalData.status ?? (statusField == null ? void 0 : statusField.defaultValue);
+    const publish = publishPermissionFor(entitySlug, createStatus);
+    if (publish && !await checkPermission(userId, teamId, publish)) {
+      throw new Error("Permission denied");
+    }
+    const storedPublish = createStatus === void 0 && statusField ? declaredPublishPermission(entitySlug) : null;
     const tableName = getTableName(entityConfig);
     const fieldNames = getFieldNames(entityConfig);
     const selectClause = buildSelectClause(fieldNames);
@@ -327,13 +336,27 @@ class GenericEntityService {
       }
     }
     const quotedFields = fields.map((f) => quoteField(f)).join(", ");
-    const result = await mutateWithRLS(
-      `INSERT INTO ${tableName} (${quotedFields})
+    const insertQuery = `INSERT INTO ${tableName} (${quotedFields})
        VALUES (${placeholders.join(", ")})
-       RETURNING ${selectClause}`,
-      values,
-      userId
-    );
+       RETURNING ${selectClause}`;
+    let result;
+    if (storedPublish) {
+      const tx = await getTransactionClient(userId);
+      let denied = false;
+      try {
+        result = await tx.mutate(insertQuery, values);
+        denied = ((_a = result.rows[0]) == null ? void 0 : _a.status) === "published" && !await checkPermission(userId, teamId, storedPublish);
+        if (denied) await tx.rollback();
+        else await tx.commit();
+      } catch (error) {
+        await tx.rollback().catch(() => {
+        });
+        throw error;
+      }
+      if (denied) throw new Error("Permission denied");
+    } else {
+      result = await mutateWithRLS(insertQuery, values, userId);
+    }
     if (!result.rows[0]) {
       throw new Error("Failed to create entity");
     }
@@ -382,6 +405,10 @@ class GenericEntityService {
     if (!validation.valid) {
       throw new Error(`Validation failed: ${validation.errors.join(", ")}`);
     }
+    const publish = "status" in finalData ? publishPermissionFor(entitySlug, finalData.status, currentEntity.status) : null;
+    if (publish && !await checkPermission(userId, teamId ?? currentEntity.teamId, publish)) {
+      throw new Error("Permission denied");
+    }
     const setClauses = [];
     const values = [];
     let paramIndex = 1;
@@ -403,6 +430,11 @@ class GenericEntityService {
     if (teamId) {
       values.push(teamId);
       updateWhereClause += ` AND "teamId" = $${paramIndex}`;
+      paramIndex++;
+    }
+    if ("status" in finalData && declaredPublishPermission(entitySlug)) {
+      values.push(currentEntity.status);
+      updateWhereClause += ` AND "status" IS NOT DISTINCT FROM $${paramIndex}`;
     }
     const result = await mutateWithRLS(
       `UPDATE ${tableName}

package/dist/lib/services/transactional-meta.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transactional-meta.service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/transactional-meta.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAGH,OAAO,EAAuB,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAaxE;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IAEpB;;;OAGG;IACH,eAAe,CAAC,EAAE,OAAO,CAAA;IAEzB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAGlC,IAAI,CAAC,EAAE,MAAM;IACb,aAAa,CAAC,EAAE,KAAK;gBAF5B,OAAO,EAAE,MAAM,EACR,IAAI,CAAC,EAAE,MAAM,EACb,aAAa,CAAC,EAAE,KAAK;CAK/B;AAED;;GAEG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAKtC;IAED;;;;;;;;;;;;;;;OAeG;WACU,cAAc,CAAC,CAAC,GAAG,OAAO,EACrC,UAAU,EAAE,UAAU,EACtB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,KAAK,CAAC,EAClC,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,CAAC,CAAC;IAoIb;;;;;;;;;OASG;WACU,kBAAkB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/D,UAAU,EAAE,UAAU,EACtB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,EACtD,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,CAAC,CAAC;IAkBb;;;;;;;;OAQG;WACU,cAAc,CACzB,UAAU,EAAE,UAAU,EACtB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC;CA0CpB"}
+{"version":3,"file":"transactional-meta.service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/transactional-meta.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAGH,OAAO,EAAuB,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAUxE;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IAEpB;;;OAGG;IACH,eAAe,CAAC,EAAE,OAAO,CAAA;IAEzB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAGlC,IAAI,CAAC,EAAE,MAAM;IACb,aAAa,CAAC,EAAE,KAAK;gBAF5B,OAAO,EAAE,MAAM,EACR,IAAI,CAAC,EAAE,MAAM,EACb,aAAa,CAAC,EAAE,KAAK;CAK/B;AAED;;GAEG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAKtC;IAED;;;;;;;;;;;;;;;OAeG;WACU,cAAc,CAAC,CAAC,GAAG,OAAO,EACrC,UAAU,EAAE,UAAU,EACtB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,KAAK,CAAC,EAClC,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,CAAC,CAAC;IAoIb;;;;;;;;;OASG;WACU,kBAAkB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/D,UAAU,EAAE,UAAU,EACtB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,EACtD,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,CAAC,CAAC;IAkBb;;;;;;;;OAQG;WACU,cAAc,CACzB,UAAU,EAAE,UAAU,EACtB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC;CA0CpB"}

package/dist/lib/services/transactional-meta.service.js

@@ -1,13 +1,10 @@
-import { Pool } from "pg";
+import { createPool } from "../db-pool.js";
 import { getEntityMetaConfig } from "../../types/meta.types.js";
 import { parseSSLConfig } from "../db.js";
 const databaseUrl = process.env.DATABASE_URL;
-const pool = new Pool({
+const pool = createPool("transactional-meta", {
   connectionString: databaseUrl,
-  ssl: parseSSLConfig(databaseUrl),
-  max: 20,
-  idleTimeoutMillis: 3e4,
-  connectionTimeoutMillis: 1e4
+  ssl: parseSSLConfig(databaseUrl)
 });
 class TransactionalError extends Error {
   constructor(message, code, originalError) {
@@ -99,7 +96,8 @@ class TransactionalMetaService {
         client.release();
         return upsertResult.rows[0].metaValue;
       } catch (error) {
-        await client.query("ROLLBACK");
+        await client.query("ROLLBACK").catch(() => {
+        });
         client.release();
         const pgError = error;
         lastError = pgError;
@@ -185,7 +183,8 @@ class TransactionalMetaService {
       client.release();
       return (result.rowCount || 0) > 0;
     } catch (error) {
-      await client.query("ROLLBACK");
+      await client.query("ROLLBACK").catch(() => {
+      });
       client.release();
       const pgError = error;
       throw new TransactionalError(

package/dist/lib/validation.d.ts

@@ -9,6 +9,11 @@ export declare const baseSignupSchema: z.ZodObject<{
     email: z.ZodString;
     password: z.ZodString;
 }, z.core.$strip>;
+export declare const inviteSignupSchema: z.ZodObject<{
+    email: z.ZodString;
+    firstName: z.ZodString;
+    lastName: z.ZodString;
+}, z.core.$strip>;
 export declare const signupSchema: z.ZodObject<{
     firstName: z.ZodString;
     lastName: z.ZodString;

package/dist/lib/validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/lib/validation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAEzB,eAAO,MAAM,WAAW;;;iBAGtB,CAAC;AAGH,eAAO,MAAM,gBAAgB;;;;;iBAU3B,CAAC;AAGH,eAAO,MAAM,YAAY;;;;;;iBAKvB,CAAC;AAEH,eAAO,MAAM,mBAAmB;;iBAE9B,CAAC;AAEH,eAAO,MAAM,iBAAiB;;;iBAW5B,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;;iBAgB/B,CAAC;AAEH,eAAO,MAAM,aAAa;;;;;;iBAMxB,CAAC;AAGH,eAAO,MAAM,oBAAoB;;;;;;iBAQ/B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AACxD,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAC1D,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AACxE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AACpE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAC1E,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC"}
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/lib/validation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAEzB,eAAO,MAAM,WAAW;;;iBAGtB,CAAC;AAGH,eAAO,MAAM,gBAAgB;;;;;iBAU3B,CAAC;AAGH,eAAO,MAAM,kBAAkB;;;;iBAA4C,CAAC;AAG5E,eAAO,MAAM,YAAY;;;;;;iBAKvB,CAAC;AAEH,eAAO,MAAM,mBAAmB;;iBAE9B,CAAC;AAEH,eAAO,MAAM,iBAAiB;;;iBAW5B,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;;iBAgB/B,CAAC;AAEH,eAAO,MAAM,aAAa;;;;;;iBAMxB,CAAC;AAGH,eAAO,MAAM,oBAAoB;;;;;;iBAQ/B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AACxD,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAC1D,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AACxE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AACpE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAC1E,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC"}

package/dist/lib/validation.js

@@ -9,6 +9,7 @@ const baseSignupSchema = z.object({
   email: z.string().email("Invalid email"),
   password: z.string().min(8, "Password must be at least 8 characters").regex(/[A-Z]/, "Must contain at least one uppercase letter").regex(/[a-z]/, "Must contain at least one lowercase letter").regex(/[0-9]/, "Must contain at least one number")
 });
+const inviteSignupSchema = baseSignupSchema.omit({ password: true });
 const signupSchema = baseSignupSchema.extend({
   confirmPassword: z.string()
 }).refine((data) => data.password === data.confirmPassword, {
@@ -56,6 +57,7 @@ const partialProfileSchema = z.object({
 export {
   baseSignupSchema,
   changePasswordSchema,
+  inviteSignupSchema,
   loginSchema,
   newPasswordSchema,
   partialProfileSchema,

package/dist/migrations/030_taxonomies_team_writes.sql

@@ -0,0 +1,29 @@
+-- Migration: 030_taxonomies_team_writes.sql
+-- Description: Taxonomy rows are written by members of their team; rows without a team only by a superadmin.
+--
+-- 021 let any authenticated user write a taxonomy row with "teamId" IS NULL. Post categories are now created in
+-- the caller's team (lib/api/post-categories.ts), and the rows without a team that earlier releases created stay
+-- readable by everyone but are changed only by a superadmin. This policy says the same on the RLS-enforced
+-- connection: reads are as before, writes need the row's team (or is_superadmin()).
+-- is_superadmin() also accepts a developer enrolled in the System Admin Team; the API (lib/api/post-categories.ts) is
+-- stricter and lets only users.role = 'superadmin' change a row without a team.
+-- Idempotent; the anon read policy from 006 is unchanged.
+
+DROP POLICY IF EXISTS "taxonomies auth can do all" ON public.taxonomies;
+DROP POLICY IF EXISTS "taxonomies auth can select" ON public.taxonomies;
+DROP POLICY IF EXISTS "taxonomies team can write" ON public.taxonomies;
+
+CREATE POLICY "taxonomies auth can select"
+ON public.taxonomies
+FOR SELECT TO authenticated
+USING (
+  "teamId" IS NULL
+  OR "teamId" = ANY(public.get_user_team_ids())
+  OR public.is_superadmin()
+);
+
+CREATE POLICY "taxonomies team can write"
+ON public.taxonomies
+FOR ALL TO authenticated
+USING ("teamId" = ANY(public.get_user_team_ids()) OR public.is_superadmin())
+WITH CHECK ("teamId" = ANY(public.get_user_team_ids()) OR public.is_superadmin());

package/dist/migrations/031_users_role_suspended.sql

@@ -0,0 +1,41 @@
+-- Migration: 031_users_role_suspended.sql
+-- Description: users.role accepts 'suspended' (lib/auth/suspension.ts).
+--
+-- The superadmin "suspend" action sets users.role = 'suspended', which check_users_role (002: member, superadmin,
+-- developer) refused. This adds 'suspended' to the roles the constraint already accepts and keeps every other one,
+-- including roles a project added to it. Idempotent: a constraint that already accepts 'suspended' is left alone. A
+-- constraint that is not a plain list of roles is left alone too, with a notice (add 'suspended' to it yourself).
+
+DO $$
+DECLARE
+  def   TEXT;
+  roles TEXT[];
+BEGIN
+  SELECT pg_get_constraintdef(c.oid) INTO def
+  FROM pg_constraint c
+  WHERE c.conrelid = 'public.users'::regclass AND c.conname = 'check_users_role';
+
+  IF def IS NULL THEN
+    ALTER TABLE public."users" ADD CONSTRAINT check_users_role
+      CHECK ("role" IN ('member', 'superadmin', 'developer', 'suspended'));
+    RETURN;
+  END IF;
+
+  IF def ~ '\msuspended\M' THEN
+    RETURN;
+  END IF;
+
+  -- "role" IN (...) is stored as: CHECK ((role = ANY (ARRAY['member'::text, ...])))
+  IF def !~ '^CHECK \(\(+"?role"?\)?(::text)? = ANY \(\(?ARRAY\[' THEN
+    RAISE NOTICE 'check_users_role is not a plain list of roles (%); add ''suspended'' to it to use the suspend action', def;
+    RETURN;
+  END IF;
+
+  SELECT array_agg(m[1]) INTO roles FROM regexp_matches(def, '''([^'']+)''', 'g') AS m;
+
+  ALTER TABLE public."users" DROP CONSTRAINT check_users_role;
+  EXECUTE format(
+    'ALTER TABLE public."users" ADD CONSTRAINT check_users_role CHECK ("role" IN (%s))',
+    (SELECT string_agg(quote_literal(r), ', ') FROM unnest(array_append(roles, 'suspended')) AS r)
+  );
+END $$;

package/dist/routes/(auth)/signup/page.cc.d.ts

@@ -1,4 +1,6 @@
 import { metadata } from './page';
 export { metadata };
-export default function SignupPageCc(): import("react/jsx-runtime").JSX.Element;
+export default function SignupPageCc({ searchParams }: {
+    searchParams: Promise<Record<string, string | string[] | undefined>>;
+}): import("react/jsx-runtime").JSX.Element;
 //# sourceMappingURL=page.cc.d.ts.map

package/dist/routes/(auth)/signup/page.cc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"page.cc.d.ts","sourceRoot":"","sources":["../../../../src/routes/(auth)/signup/page.cc.tsx"],"names":[],"mappings":"AAUA,OAAmB,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAA;AAE7C,OAAO,EAAE,QAAQ,EAAE,CAAA;AAEnB,MAAM,CAAC,OAAO,UAAU,YAAY,4CAMnC"}
+{"version":3,"file":"page.cc.d.ts","sourceRoot":"","sources":["../../../../src/routes/(auth)/signup/page.cc.tsx"],"names":[],"mappings":"AAUA,OAAmB,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAA;AAE7C,OAAO,EAAE,QAAQ,EAAE,CAAA;AAEnB,MAAM,CAAC,OAAO,UAAU,YAAY,CAAC,EAAE,YAAY,EAAE,EAAE;IAAE,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAA;CAAE,2CAM9H"}

package/dist/routes/(auth)/signup/page.cc.js

@@ -2,6 +2,6 @@ import { jsx } from "react/jsx-runtime";
 import { Suspense } from "react";
 import SignupPage, { metadata } from "./page.js";
 export { metadata };
-export default function SignupPageCc() {
-  return /* @__PURE__ */ jsx(Suspense, { fallback: null, children: /* @__PURE__ */ jsx(SignupPage, {}) });
+export default function SignupPageCc({ searchParams }) {
+  return /* @__PURE__ */ jsx(Suspense, { fallback: null, children: /* @__PURE__ */ jsx(SignupPage, { searchParams }) });
 }

package/dist/routes/(auth)/signup/page.d.ts

@@ -1,6 +1,8 @@
 import type { Metadata } from 'next';
 export declare const dynamic = "force-dynamic";
 export declare const metadata: Metadata;
-declare function SignupPage(): Promise<import("react/jsx-runtime").JSX.Element>;
+declare function SignupPage({ searchParams }: {
+    searchParams?: Promise<Record<string, string | string[] | undefined>>;
+}): Promise<import("react/jsx-runtime").JSX.Element>;
 export default SignupPage;
 //# sourceMappingURL=page.d.ts.map

package/dist/routes/(auth)/signup/page.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"page.d.ts","sourceRoot":"","sources":["../../../../src/routes/(auth)/signup/page.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAA;AASpC,eAAO,MAAM,OAAO,kBAAkB,CAAA;AAOtC,eAAO,MAAM,QAAQ,EAAE,QAA0B,CAAA;AAKjD,iBAAe,UAAU,qDA4BxB;AAED,eAAe,UAAU,CAAA"}
+{"version":3,"file":"page.d.ts","sourceRoot":"","sources":["../../../../src/routes/(auth)/signup/page.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAA;AASpC,eAAO,MAAM,OAAO,kBAAkB,CAAA;AAOtC,eAAO,MAAM,QAAQ,EAAE,QAA0B,CAAA;AAKjD,iBAAe,UAAU,CAAC,EAAE,YAAY,EAAE,EAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAA;CAAE,oDA8BpH;AAED,eAAe,UAAU,CAAA"}

package/dist/routes/(auth)/signup/page.js

@@ -10,10 +10,11 @@ const defaultMetadata = {
   description: "Create your account to start using our platform"
 };
 export const metadata = defaultMetadata;
-async function SignupPage() {
-  var _a, _b;
+async function SignupPage({ searchParams }) {
+  var _a, _b, _c;
   const registrationMode = ((_b = (_a = AUTH_CONFIG) == null ? void 0 : _a.registration) == null ? void 0 : _b.mode) ?? "open";
-  if (!resolveAuthMethods(AUTH_CONFIG).includes("email-password")) {
+  const invited = typeof ((_c = await searchParams) == null ? void 0 : _c.inviteToken) === "string";
+  if (!invited && !resolveAuthMethods(AUTH_CONFIG).includes("email-password")) {
     redirect("/login");
   }
   if (registrationMode === "invitation-only") {