@supacloud/lite 0.2.0

package/dist/project-runtime.d.ts

@@ -0,0 +1,65 @@
+import { type TinbaseBackend } from './vendor/tinbase/index.js';
+import { type RunningServer } from './vendor/tinbase/node/bun-server.js';
+import { type ProjectConfig } from './vendor/tinbase/node/load-config.js';
+import { type S3StorageDriverOptions } from './vendor/tinbase/storage/s3-driver.js';
+import type { StorageDriver } from './vendor/tinbase/types.js';
+export interface ProjectSecrets {
+    jwtSecret: string;
+    vaultKey: string;
+    createdAt: string;
+}
+export interface ProjectPaths {
+    projectDir: string;
+    stateDir: string;
+    dataDir?: string;
+    storageDir: string;
+    secretsFile: string;
+}
+export interface ProjectRuntimeOptions {
+    projectDir?: string;
+    stateDir?: string;
+    dataDir?: string;
+    storageDir?: string;
+    storageBackend?: ConfiguredStorageBackend;
+    storageDriver?: StorageDriver;
+    s3?: S3StorageDriverOptions;
+    host?: string;
+    port?: number;
+    apiUrl?: string;
+    siteUrl?: string;
+    memory?: boolean;
+    applyMigrations?: boolean;
+    includeFunctions?: boolean;
+    includeWebhooks?: boolean;
+    includeSeed?: boolean;
+    log?: (message: string) => void;
+}
+export interface ProjectBackend {
+    backend: TinbaseBackend;
+    config: ProjectConfig;
+    paths: ProjectPaths;
+    host: string;
+    port: number;
+    url: string;
+    migrationCount: number;
+    functionNames: string[];
+    webhookCount: number;
+    storageBackend: StorageBackend;
+}
+export type StorageBackend = 'fs' | 'memory' | 's3' | 'custom';
+export type ConfiguredStorageBackend = Exclude<StorageBackend, 'custom'>;
+export interface RunningProjectServer extends ProjectBackend {
+    server: RunningServer;
+    close: () => Promise<void>;
+}
+export declare function resolveProjectPaths(options?: ProjectRuntimeOptions): ProjectPaths;
+export declare function assertResetPathsSafe(paths: ProjectPaths): Promise<void>;
+export declare function ensureProjectSecrets(paths: ProjectPaths): Promise<ProjectSecrets>;
+export declare function mintProjectKeys(jwtSecret: string): Promise<{
+    anonKey: string;
+    serviceRoleKey: string;
+}>;
+export declare function createProjectBackend(options?: ProjectRuntimeOptions): Promise<ProjectBackend>;
+export declare function resolveStorageBackend(value?: ConfiguredStorageBackend): ConfiguredStorageBackend;
+export declare function startProjectServer(options?: ProjectRuntimeOptions): Promise<RunningProjectServer>;
+//# sourceMappingURL=project-runtime.d.ts.map

package/dist/project-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-runtime.d.ts","sourceRoot":"","sources":["../src/project-runtime.ts"],"names":[],"mappings":"AAEA,OAAO,EAA0B,KAAK,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAEvF,OAAO,EAAY,KAAK,aAAa,EAAE,MAAM,qCAAqC,CAAA;AAElF,OAAO,EAAqB,KAAK,aAAa,EAAE,MAAM,sCAAsC,CAAA;AAI5F,OAAO,EAAmB,KAAK,sBAAsB,EAAE,MAAM,uCAAuC,CAAA;AACpG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAA;AAE9D,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,cAAc,CAAC,EAAE,wBAAwB,CAAA;IACzC,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,EAAE,CAAC,EAAE,sBAAsB,CAAA;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAChC;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,cAAc,CAAA;IACvB,MAAM,EAAE,aAAa,CAAA;IACrB,KAAK,EAAE,YAAY,CAAA;IACnB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;IACX,cAAc,EAAE,MAAM,CAAA;IACtB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,EAAE,cAAc,CAAA;CAC/B;AAED,MAAM,MAAM,cAAc,GAAG,IAAI,GAAG,QAAQ,GAAG,IAAI,GAAG,QAAQ,CAAA;AAC9D,MAAM,MAAM,wBAAwB,GAAG,OAAO,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAA;AAExE,MAAM,WAAW,oBAAqB,SAAQ,cAAc;IAC1D,MAAM,EAAE,aAAa,CAAA;IACrB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3B;AAED,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,qBAA0B,GAAG,YAAY,CAiBrF;AAED,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA4B7E;AA4CD,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAqCvF;AAED,wBAAsB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC,CAQ7G;AAED,wBAAsB,oBAAoB,CAAC,OAAO,GAAE,qBAA0B,GAAG,OAAO,CAAC,cAAc,CAAC,CAmEvG;AAED,wBAAgB,qBAAqB,CAAC,KAAK,CAAC,EAAE,wBAAwB,GAAG,wBAAwB,CAIhG;AAiBD,wBAAsB,kBAAkB,CAAC,OAAO,GAAE,qBAA0B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAiC3G"}

package/dist/vendor/tinbase/auth/handler.d.ts

@@ -0,0 +1,140 @@
+/**
+ * GoTrue-compatible auth endpoints (/auth/v1/*) - the subset supabase-js
+ * uses for email/password auth, sessions, and admin user management.
+ */
+import type { Database } from '../db/database.js';
+import type { Mailer, RequestContext } from '../types.js';
+import { type OAuthProviderConfig } from './oauth.js';
+import { type AuthSettings } from './settings.js';
+import { RateLimiter } from './rate-limit.js';
+/** Construction-time config for {@link AuthHandler}. */
+export interface AuthConfig {
+    /** HS256 secret used to sign and verify access tokens */
+    jwtSecret: string;
+    /** public API URL of this instance; used as issuer, OAuth callback, and email-link base */
+    apiUrl: string;
+    /** frontend URL used as the default redirect target */
+    siteUrl: string;
+    /** Access-token lifetime in seconds. */
+    jwtExpiry: number;
+    /** Force sign-out after this many seconds (config.toml auth.sessions.timebox). Caps session lifetime. */
+    sessionTimeboxSeconds?: number;
+    /** Reject refresh after this many seconds without refresh activity. */
+    sessionInactivitySeconds?: number;
+    /** sends outgoing auth email (magic links, OTP codes, recovery) */
+    mailer: Mailer;
+    /** OAuth providers to enable, keyed by provider name (google, github, …) */
+    oauthProviders?: Record<string, OAuthProviderConfig>;
+    /** injectable fetch for the OAuth provider calls (tests use a mock provider) */
+    oauthFetch?: typeof fetch;
+    /**
+     * Additional redirect targets allowed beyond the site URL's own origin
+     * (GoTrue's URI_ALLOW_LIST). Entries may use `*`/`**` globs. A `redirect_to`
+     * that matches neither the site origin nor an entry falls back to the site URL.
+     */
+    uriAllowList?: string[];
+    /**
+     * Enforce the redirect allowlist strictly. Off for local dev (any well-formed
+     * URL is honored, like `supabase start`); the backend turns it on when
+     * network-exposed so redirects can't leave the allowed origins.
+     */
+    enforceRedirectAllowList?: boolean;
+    /**
+     * Runtime-mutable toggles (signups, anonymous users, autoconfirm…). The
+     * admin API mutates this same object in place, so changes apply instantly.
+     */
+    settings?: AuthSettings;
+    /**
+     * Rate limiter for login/signup/OTP/recovery. Defaults to a fresh in-memory
+     * limiter with GoTrue-shaped windows; pass `null` to disable (e.g. tests).
+     */
+    rateLimiter?: RateLimiter | null;
+}
+interface UserRow {
+    id: string;
+    aud: string | null;
+    role: string | null;
+    email: string | null;
+    encrypted_password: string | null;
+    email_confirmed_at: Date | string | null;
+    last_sign_in_at: Date | string | null;
+    raw_app_meta_data: Record<string, unknown> | null;
+    raw_user_meta_data: Record<string, unknown> | null;
+    created_at: Date | string | null;
+    updated_at: Date | string | null;
+    phone: string | null;
+    phone_confirmed_at: Date | string | null;
+    is_anonymous: boolean | null;
+}
+/** Routes and services the GoTrue-compatible `/auth/v1/*` endpoints. */
+export declare class AuthHandler {
+    private db;
+    private config;
+    private oauth;
+    /** Shared, runtime-mutable settings - read on every request, never copied. */
+    private settings;
+    private rateLimiter;
+    constructor(db: Database, config: AuthConfig);
+    /**
+     * Enforce the rate limit for `action`, keyed by client address. Returns a 429
+     * (GoTrue's `over_request_rate_limit`) when exceeded, else null to proceed.
+     */
+    private limit;
+    /** Stop background timers (rate-limiter sweep). Called on backend close. */
+    stop(): void;
+    /** Dispatch one `/auth/v1/*` request. Any thrown error becomes a 500 `unexpected_failure`. */
+    handle(req: Request, ctx: RequestContext, url: URL): Promise<Response>;
+    private signup;
+    private token;
+    private getUser;
+    private updateUser;
+    private logout;
+    private issueToken;
+    private sendOtp;
+    private sendRecovery;
+    /** Max wrong guesses for a one-time code before its tokens are invalidated. */
+    private static readonly MAX_OTP_ATTEMPTS;
+    private redeem;
+    private verifyToken;
+    private verifyLink;
+    private admin;
+    /**
+     * Append a security event to auth.audit_log_entries (GoTrue-compatible
+     * payload). Best-effort: a logging failure never breaks the request.
+     */
+    private audit;
+    /**
+     * Export everything held about one user across the auth schema, for a GDPR
+     * right-of-access / portability request. Credentials (password hash, MFA
+     * secrets, raw token values) are deliberately omitted - they are not personal
+     * data to hand back and exporting them would leak secrets.
+     */
+    private exportUser;
+    /**
+     * Erase a user (GDPR right to erasure). Deletes the user row; auth.identities,
+     * refresh_tokens, one_time_tokens, flow_state, and mfa_factors/challenges are
+     * removed by their ON DELETE CASCADE foreign keys. Returns a 404 if the user
+     * doesn't exist and a summary of what was erased.
+     *
+     * Note: storage.objects.owner has no FK to auth.users, so object rows/bytes
+     * owned by the user are not removed here - see COMPLIANCE.md for the
+     * storage-erasure step the operator must run.
+     */
+    private eraseUser;
+    private enrollFactor;
+    private challengeFactor;
+    private verifyFactor;
+    private unenrollFactor;
+    private getUserFactors;
+    /** GoTrue-shaped identities for a user (linked providers), from auth.identities. */
+    private getUserIdentities;
+    private userFromBearer;
+    private claimsFromBearer;
+    /** Shape a user row into the GoTrue user object supabase-js expects. */
+    userJson(u: UserRow, factors?: Record<string, unknown>[], identities?: Record<string, unknown>[]): Record<string, unknown>;
+    /** Session tokens for a bare user id (used by the OAuth implicit callback). */
+    private sessionTokensFor;
+    private sessionFor;
+}
+export {};
+//# sourceMappingURL=handler.d.ts.map

package/dist/vendor/tinbase/auth/handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../../src/vendor/tinbase/auth/handler.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAEzD,OAAO,EAAgB,KAAK,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAGnE,OAAO,EAAyB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAA;AAExE,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAG7C,wDAAwD;AACxD,MAAM,WAAW,UAAU;IACzB,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAA;IACjB,2FAA2F;IAC3F,MAAM,EAAE,MAAM,CAAA;IACd,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAA;IACf,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAA;IACjB,yGAAyG;IACzG,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,uEAAuE;IACvE,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAA;IACd,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;IACpD,gFAAgF;IAChF,UAAU,CAAC,EAAE,OAAO,KAAK,CAAA;IACzB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAA;IAClC;;;OAGG;IACH,QAAQ,CAAC,EAAE,YAAY,CAAA;IACvB;;;OAGG;IACH,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAA;CACjC;AAED,UAAU,OAAO;IACf,EAAE,EAAE,MAAM,CAAA;IACV,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,kBAAkB,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IACxC,eAAe,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IACrC,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IACjD,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IAClD,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAChC,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAChC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,kBAAkB,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IACxC,YAAY,EAAE,OAAO,GAAG,IAAI,CAAA;CAC7B;AAkCD,wEAAwE;AACxE,qBAAa,WAAW;IAOpB,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,MAAM;IAPhB,OAAO,CAAC,KAAK,CAAc;IAC3B,8EAA8E;IAC9E,OAAO,CAAC,QAAQ,CAAc;IAC9B,OAAO,CAAC,WAAW,CAAoB;gBAG7B,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,UAAU;IAe5B;;;OAGG;IACH,OAAO,CAAC,KAAK;IAWb,4EAA4E;IAC5E,IAAI,IAAI,IAAI;IAIZ,8FAA8F;IACxF,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;YA2D9D,MAAM;YAiEN,KAAK;YA6FL,OAAO;YAMP,UAAU;YAgEV,MAAM;YAwBN,UAAU;YA4CV,OAAO;YAMP,YAAY;IAM1B,+EAA+E;IAC/E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAI;YAE9B,MAAM;YAqCN,WAAW;YAaX,UAAU;YAuBV,KAAK;IA2FnB;;;OAGG;YACW,KAAK;IAqBnB;;;;;OAKG;YACW,UAAU;IA2CxB;;;;;;;;;OASG;YACW,SAAS;YAqBT,YAAY;YAyDZ,eAAe;YAqBf,YAAY;YAyCZ,cAAc;YAWd,cAAc;IAgB5B,oFAAoF;YACtE,iBAAiB;YAoBjB,cAAc;YAOd,gBAAgB;IAM9B,wEAAwE;IACxE,QAAQ,CACN,CAAC,EAAE,OAAO,EACV,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAO,EACvC,UAAU,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAO,GACzC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAoB1B,+EAA+E;YACjE,gBAAgB;YAUhB,UAAU;CAoDzB"}

package/dist/vendor/tinbase/auth/inbox.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Local email inbox - the tinbase equivalent of Supabase local's Inbucket /
+ * Mailpit. When no custom mailer is configured, outgoing auth emails (magic
+ * links, OTP codes, password recovery, email-change confirmations) are captured
+ * in memory and viewable at /inbox, so you can test those flows locally without
+ * a real SMTP server.
+ *
+ * Dev-only by nature: it exposes email contents (including sign-in links) with
+ * no auth, exactly like Inbucket. Not for production - provide your own
+ * `mailer` there and no inbox is mounted.
+ */
+import type { MailMessage, Mailer } from '../types.js';
+/** A captured message plus the link/code extracted from its body for the inbox UI. */
+export interface InboxEntry extends MailMessage {
+    id: string;
+    created_at: string;
+    /** first URL found in the body (the magic/confirm/recovery link), if any */
+    link: string | null;
+    /** first 6-digit code found in the body (the OTP), if any */
+    code: string | null;
+}
+/** In-memory {@link Mailer} that captures the most recent {@link CAP} messages and serves the /inbox UI. */
+export declare class InboxMailer implements Mailer {
+    private passthrough?;
+    private messages;
+    /** `passthrough` still receives every message (e.g. to also log to console). */
+    constructor(passthrough?: ((msg: MailMessage) => void) | undefined);
+    send(msg: MailMessage): Promise<void>;
+    list(): InboxEntry[];
+    clear(): void;
+    /** Serve GET /inbox (HTML), GET /inbox/api/messages (JSON), DELETE (clear). */
+    serve(req: Request, url: URL): Response;
+}
+//# sourceMappingURL=inbox.d.ts.map

package/dist/vendor/tinbase/auth/inbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inbox.d.ts","sourceRoot":"","sources":["../../../../src/vendor/tinbase/auth/inbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEtD,sFAAsF;AACtF,MAAM,WAAW,UAAW,SAAQ,WAAW;IAC7C,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;IAClB,4EAA4E;IAC5E,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,6DAA6D;IAC7D,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CACpB;AAID,4GAA4G;AAC5G,qBAAa,WAAY,YAAW,MAAM;IAI5B,OAAO,CAAC,WAAW,CAAC;IAHhC,OAAO,CAAC,QAAQ,CAAmB;IAEnC,gFAAgF;gBAC5D,WAAW,CAAC,GAAE,CAAC,GAAG,EAAE,WAAW,KAAK,IAAI,aAAA;IAEtD,IAAI,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAY3C,IAAI,IAAI,UAAU,EAAE;IAGpB,KAAK,IAAI,IAAI;IAIb,+EAA+E;IAC/E,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,QAAQ;CAkBxC"}

package/dist/vendor/tinbase/auth/oauth.d.ts

@@ -0,0 +1,88 @@
+/**
+ * OAuth 2.0 / OIDC provider support for GoTrue-compatible sign-in.
+ *
+ * Flow (matches hosted Supabase):
+ *   GET /authorize?provider=…  → 302 to the provider, state persisted
+ *   provider → GET /callback?code=…&state=…
+ *     → exchange code for a provider token, fetch the profile, upsert the
+ *       user + identity, then:
+ *         - PKCE: redirect to redirect_to?code=<auth_code>  (client calls
+ *           exchangeCodeForSession → POST /token?grant_type=pkce)
+ *         - implicit: redirect to redirect_to#access_token=…&refresh_token=…
+ */
+import type { Database } from '../db/database.js';
+/** Operator-supplied config for one OAuth provider. Endpoint URLs are optional for presets (google, github). */
+export interface OAuthProviderConfig {
+    /** OAuth client id issued by the provider */
+    clientId: string;
+    /** OAuth client secret issued by the provider */
+    clientSecret: string;
+    /** Overrides; filled from a preset for known providers (google, github). */
+    authorizeUrl?: string;
+    /** token endpoint; filled from a preset when omitted */
+    tokenUrl?: string;
+    /** userinfo endpoint; filled from a preset when omitted */
+    userInfoUrl?: string;
+    /** space-separated scopes to request; falls back to the preset's */
+    scopes?: string;
+    /** Map the provider's raw userinfo JSON to a normalized profile. */
+    profileMap?: (raw: any) => OAuthProfile;
+}
+/** Normalized profile extracted from a provider's userinfo response. */
+export interface OAuthProfile {
+    /** Provider-local user id (becomes auth.identities.provider_id). */
+    id: string;
+    /** email address the provider returned, if any */
+    email?: string;
+    /** Whether the provider asserts the email is verified; gated for account linking. */
+    emailVerified?: boolean;
+    /** display name the provider returned, if any */
+    name?: string;
+    /** extra provider fields (avatar, username, …) merged into identity_data */
+    metadata?: Record<string, unknown>;
+}
+interface ResolvedProvider extends Required<Omit<OAuthProviderConfig, 'profileMap'>> {
+    name: string;
+    profileMap: (raw: any) => OAuthProfile;
+}
+/**
+ * Merge operator config with the built-in preset for `name` into a fully
+ * resolved provider.
+ *
+ * @throws if no endpoint URLs are supplied and no preset exists for `name`.
+ */
+export declare function resolveProvider(name: string, cfg: OAuthProviderConfig): ResolvedProvider;
+/** Drives the OAuth authorize/callback/PKCE flows against the configured providers. */
+export declare class OAuthService {
+    private db;
+    private apiUrl;
+    private siteUrl;
+    private fetchImpl;
+    private uriAllowList;
+    private enforceRedirectAllowList;
+    private providers;
+    constructor(db: Database, apiUrl: string, siteUrl: string, configs: Record<string, OAuthProviderConfig>, fetchImpl?: typeof fetch, uriAllowList?: string[], enforceRedirectAllowList?: boolean);
+    /** Whether a provider by this name is configured. */
+    has(name: string): boolean;
+    private callbackUrl;
+    /** GET /authorize - persist state, redirect to the provider. */
+    authorize(url: URL): Promise<Response>;
+    /** GET /callback - exchange code, upsert user+identity, redirect back. */
+    callback(url: URL, createSession: (userId: string) => Promise<OAuthSession>): Promise<Response>;
+    /** POST /token?grant_type=pkce - exchange an auth code + verifier for a session. */
+    exchangePkce(authCode: string, verifier: string): Promise<string | null>;
+    private exchangeCode;
+    private fetchProfile;
+    private upsertUser;
+}
+/** The minimal session the callback puts in the redirect fragment for the implicit flow. */
+export interface OAuthSession {
+    /** signed access token (JWT) */
+    access_token: string;
+    /** opaque refresh token */
+    refresh_token: string;
+    /** access-token lifetime in seconds */
+    expires_in: number;
+}
+export {};
+//# sourceMappingURL=oauth.d.ts.map

package/dist/vendor/tinbase/auth/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../../src/vendor/tinbase/auth/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAIjD,gHAAgH;AAChH,MAAM,WAAW,mBAAmB;IAClC,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,CAAA;IAChB,iDAAiD;IACjD,YAAY,EAAE,MAAM,CAAA;IACpB,4EAA4E;IAC5E,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,oEAAoE;IACpE,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,YAAY,CAAA;CACxC;AAED,wEAAwE;AACxE,MAAM,WAAW,YAAY;IAC3B,oEAAoE;IACpE,EAAE,EAAE,MAAM,CAAA;IACV,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,qFAAqF;IACrF,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,iDAAiD;IACjD,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC;AAED,UAAU,gBAAiB,SAAQ,QAAQ,CAAC,IAAI,CAAC,mBAAmB,EAAE,YAAY,CAAC,CAAC;IAClF,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,YAAY,CAAA;CACvC;AAyBD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,mBAAmB,GAAG,gBAAgB,CAkBxF;AAED,uFAAuF;AACvF,qBAAa,YAAY;IAIrB,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,OAAO;IAEf,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,YAAY;IACpB,OAAO,CAAC,wBAAwB;IATlC,OAAO,CAAC,SAAS,CAAsC;gBAG7C,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACvB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,EACpC,SAAS,GAAE,OAAO,KAAa,EAC/B,YAAY,GAAE,MAAM,EAAO,EAC3B,wBAAwB,UAAQ;IAO1C,qDAAqD;IACrD,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI1B,OAAO,CAAC,WAAW;IAInB,gEAAgE;IAC1D,SAAS,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;IAgC5C,0EAA0E;IACpE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;IA0CrG,oFAAoF;IAC9E,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;YAiBhE,YAAY;YAmBZ,YAAY;YAUZ,UAAU;CAwDzB;AAED,4FAA4F;AAC5F,MAAM,WAAW,YAAY;IAC3B,gCAAgC;IAChC,YAAY,EAAE,MAAM,CAAA;IACpB,2BAA2B;IAC3B,aAAa,EAAE,MAAM,CAAA;IACrB,uCAAuC;IACvC,UAAU,EAAE,MAAM,CAAA;CACnB"}

package/dist/vendor/tinbase/auth/password.d.ts

@@ -0,0 +1,9 @@
+/** Bun bcrypt hashing with PBKDF2 verification retained for pre-release Lite databases. */
+/** Hash a password using bcrypt so imported GoTrue-compatible password rows remain usable. */
+export declare function hashPassword(password: string): Promise<string>;
+/**
+ * Verify a password against a stored `pbkdf2$…` hash, re-deriving with the
+ * salt/iterations embedded in it. Returns false for any malformed hash.
+ */
+export declare function verifyPassword(password: string, stored: string): Promise<boolean>;
+//# sourceMappingURL=password.d.ts.map

package/dist/vendor/tinbase/auth/password.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../../../src/vendor/tinbase/auth/password.ts"],"names":[],"mappings":"AAAA,2FAA2F;AA0B3F,8FAA8F;AAC9F,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAEpE;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CA6BvF"}

package/dist/vendor/tinbase/auth/qr.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Minimal QR Code generator (byte mode, full version/ECC/mask support) used to
+ * render the MFA enrollment otpauth:// URI as a scannable SVG. Compact port of
+ * Nayuki's public-domain "QR Code generator" algorithm - no dependencies.
+ * Source of the algorithm: https://www.nayuki.io/page/qr-code-generator-library
+ */
+/** Encode `text` as a QR SVG data URI (works directly as an <img src>). */
+export declare function qrSvgDataUri(text: string): string;
+//# sourceMappingURL=qr.d.ts.map

package/dist/vendor/tinbase/auth/qr.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"qr.d.ts","sourceRoot":"","sources":["../../../../src/vendor/tinbase/auth/qr.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AA8VH,2EAA2E;AAC3E,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGjD"}

package/dist/vendor/tinbase/auth/rate-limit.d.ts

@@ -0,0 +1,34 @@
+/**
+ * In-memory sliding-window rate limiter for auth endpoints. GoTrue throttles
+ * login/signup/OTP/recovery to blunt brute-force and mail-flooding; tinbase
+ * mirrors that with per-key windows and returns the same 429 /
+ * `over_request_rate_limit` shape. State is per-process (no external store),
+ * which is sufficient for a single-process local backend.
+ */
+/** A single sliding-window limit: at most `limit` hits per `windowMs`. */
+export interface RateLimitRule {
+    /** max requests permitted within the window */
+    limit: number;
+    /** window length in milliseconds */
+    windowMs: number;
+}
+/** Default per-endpoint rules, keyed by the logical action being throttled. */
+export declare const DEFAULT_AUTH_RATE_LIMITS: Record<string, RateLimitRule>;
+/** Per-key sliding-window counter with one background sweep to drop stale buckets. */
+export declare class RateLimiter {
+    private hits;
+    private timer;
+    private rules;
+    /** `overrides` (e.g. from config.toml auth.rate_limit.*) replace the matching defaults. */
+    constructor(overrides?: Record<string, RateLimitRule>);
+    /**
+     * Record an attempt for `action` by `key` (typically IP + identifier).
+     * Returns `null` when allowed, or the seconds until the window frees up when
+     * the limit is exceeded.
+     */
+    check(action: string, key: string, now?: number): number | null;
+    private sweep;
+    /** Stop the background sweep timer. */
+    stop(): void;
+}
+//# sourceMappingURL=rate-limit.d.ts.map

package/dist/vendor/tinbase/auth/rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../../src/vendor/tinbase/auth/rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,0EAA0E;AAC1E,MAAM,WAAW,aAAa;IAC5B,+CAA+C;IAC/C,KAAK,EAAE,MAAM,CAAA;IACb,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,+EAA+E;AAC/E,eAAO,MAAM,wBAAwB,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAOlE,CAAA;AAED,sFAAsF;AACtF,qBAAa,WAAW;IACtB,OAAO,CAAC,IAAI,CAA8B;IAC1C,OAAO,CAAC,KAAK,CAA8C;IAE3D,OAAO,CAAC,KAAK,CAA+B;IAE5C,2FAA2F;gBAC/E,SAAS,GAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAM;IAQzD;;;;OAIG;IACH,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,GAAE,MAAmB,GAAG,MAAM,GAAG,IAAI;IAe3E,OAAO,CAAC,KAAK;IAMb,uCAAuC;IACvC,IAAI,IAAI,IAAI;CAIb"}

package/dist/vendor/tinbase/auth/redirect.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Redirect-URL validation, matching GoTrue's URI_ALLOW_LIST behavior: a
+ * client-supplied `redirect_to` is only honored when it is same-origin with the
+ * site URL or matches a configured allowlist entry. Anything else falls back to
+ * the site URL, so a crafted magic-link/OAuth URL can't redirect a victim (and
+ * the freshly minted session tokens) to an attacker-controlled origin.
+ */
+/**
+ * Resolve the redirect target: return `requested` when it is allowed, otherwise
+ * fall back to `siteUrl`. `requested` is allowed when it is same-origin with
+ * `siteUrl` or matches any `allowList` glob.
+ *
+ * When `enforce` is false (the default for a loopback/local-dev backend), any
+ * well-formed absolute URL is honored - matching how `supabase start` lets a
+ * dev redirect anywhere locally. The backend sets `enforce` to true once bound
+ * to a network-exposed host, at which point the allowlist is strict.
+ */
+export declare function resolveRedirect(requested: string | null | undefined, siteUrl: string, allowList?: string[], enforce?: boolean): string;
+/** Whether `requested` is same-origin with `siteUrl` or matches the allowlist. */
+export declare function isAllowedRedirect(requested: string, siteUrl: string, allowList?: string[]): boolean;
+//# sourceMappingURL=redirect.d.ts.map

package/dist/vendor/tinbase/auth/redirect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect.d.ts","sourceRoot":"","sources":["../../../../src/vendor/tinbase/auth/redirect.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA2BH;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACpC,OAAO,EAAE,MAAM,EACf,SAAS,GAAE,MAAM,EAAO,EACxB,OAAO,UAAQ,GACd,MAAM,CAYR;AAED,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,GAAE,MAAM,EAAO,GAAG,OAAO,CAavG"}

package/dist/vendor/tinbase/auth/settings.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Runtime-mutable auth settings - the knobs Studio's "Sign In / Providers"
+ * page toggles. One shared object is created at boot, read by the auth
+ * handler on every request, mutated in place by the admin API, and persisted
+ * to the auth.config kv table so restarts keep the operator's choices.
+ */
+import type { Database } from '../db/database.js';
+/**
+ * Runtime-mutable auth configuration. One shared instance is read by the auth
+ * handler on every request and edited in place by the admin API, so changes
+ * apply immediately; it is persisted to auth.config to survive restarts.
+ */
+export interface AuthSettings {
+    /** When true, new email/password signups are rejected (existing users can still sign in). */
+    disableSignup: boolean;
+    /** Allow signInAnonymously() to mint temporary users. */
+    anonymousUsers: boolean;
+    /** Confirm email addresses automatically on signup. When false, users must verify via the emailed link before signing in. */
+    autoconfirm: boolean;
+    /** Minimum accepted password length (signup, updateUser, admin create). */
+    minPasswordLength: number;
+    /** Configured OAuth providers the operator has switched off at runtime. */
+    disabledProviders: string[];
+    /** Digits in emailed OTP codes (config.toml auth.email.otp_length; 6-10). */
+    otpLength: number;
+    /** OTP / magic-link lifetime in seconds (auth.email.otp_expiry). */
+    otpExpirySeconds: number;
+    /** Max MFA factors a user may enroll (auth.mfa.max_enrolled_factors). */
+    maxEnrolledFactors: number;
+    /** Allow TOTP enrollment (auth.mfa.totp.enroll_enabled). */
+    totpEnrollEnabled: boolean;
+    /** Allow TOTP verification/challenge (auth.mfa.totp.verify_enabled). */
+    totpVerifyEnabled: boolean;
+}
+/** Built-in defaults, matching `supabase start`'s permissive local posture (autoconfirm on, anonymous users on). */
+export declare const DEFAULT_AUTH_SETTINGS: AuthSettings;
+/**
+ * Resolve the effective auth settings by layering, low precedence first:
+ *   1. built-in defaults
+ *   2. `defaults` - the committed baseline (config.toml [auth]); portable, in VCS
+ *   3. the persisted auth.config row - per-instance live overrides from the studio
+ *
+ * config.toml stays the source of truth a project commits; the studio's live
+ * toggles are overrides on top, so both models coexist.
+ */
+export declare function loadAuthSettings(db: Database, defaults?: Partial<AuthSettings>): Promise<AuthSettings>;
+/** Persist the settings object to auth.config. */
+export declare function saveAuthSettings(db: Database, settings: AuthSettings): Promise<void>;
+/**
+ * Apply a partial patch onto the shared settings object IN PLACE (so every
+ * holder of the reference - the auth handler - sees the change immediately).
+ *
+ * @returns An error message for an invalid patch, or `null` on success.
+ */
+export declare function applyAuthSettingsPatch(target: AuthSettings, patch: Record<string, unknown>): string | null;
+//# sourceMappingURL=settings.d.ts.map

package/dist/vendor/tinbase/auth/settings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings.d.ts","sourceRoot":"","sources":["../../../../src/vendor/tinbase/auth/settings.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAEjD;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,6FAA6F;IAC7F,aAAa,EAAE,OAAO,CAAA;IACtB,yDAAyD;IACzD,cAAc,EAAE,OAAO,CAAA;IACvB,6HAA6H;IAC7H,WAAW,EAAE,OAAO,CAAA;IACpB,2EAA2E;IAC3E,iBAAiB,EAAE,MAAM,CAAA;IACzB,2EAA2E;IAC3E,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,6EAA6E;IAC7E,SAAS,EAAE,MAAM,CAAA;IACjB,oEAAoE;IACpE,gBAAgB,EAAE,MAAM,CAAA;IACxB,yEAAyE;IACzE,kBAAkB,EAAE,MAAM,CAAA;IAC1B,4DAA4D;IAC5D,iBAAiB,EAAE,OAAO,CAAA;IAC1B,wEAAwE;IACxE,iBAAiB,EAAE,OAAO,CAAA;CAC3B;AAED,oHAAoH;AACpH,eAAO,MAAM,qBAAqB,EAAE,YAWnC,CAAA;AA4BD;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,GAAE,OAAO,CAAC,YAAY,CAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAShH;AAED,kDAAkD;AAClD,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAM1F;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,IAAI,CAqC1G"}

package/dist/vendor/tinbase/auth/totp.d.ts

@@ -0,0 +1,20 @@
+/** Encode bytes as unpadded RFC 4648 base32 (the format authenticator apps expect). */
+export declare function base32Encode(bytes: Uint8Array): string;
+/** Decode an unpadded/padded base32 string to bytes (case-insensitive). */
+export declare function base32Decode(input: string): Uint8Array;
+/** A fresh 20-byte (160-bit) base32 secret, the GoTrue/authenticator default. */
+export declare function generateTotpSecret(): string;
+/** Build the otpauth:// URI an authenticator app scans. */
+export declare function otpauthUri(opts: {
+    secret: string;
+    account: string;
+    issuer: string;
+}): string;
+/** Current 6-digit code for a base32 secret (used in tests and self-checks). */
+export declare function totpNow(secretBase32: string, atMs?: number): Promise<string>;
+/**
+ * Verify a submitted code against the secret, allowing ±`window` steps of
+ * clock skew (default ±1 = a 90-second acceptance window, like GoTrue).
+ */
+export declare function verifyTotp(secretBase32: string, code: string, window?: number, atMs?: number): Promise<boolean>;
+//# sourceMappingURL=totp.d.ts.map

package/dist/vendor/tinbase/auth/totp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.d.ts","sourceRoot":"","sources":["../../../../src/vendor/tinbase/auth/totp.ts"],"names":[],"mappings":"AAQA,uFAAuF;AACvF,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CActD;AAED,2EAA2E;AAC3E,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAgBtD;AAED,iFAAiF;AACjF,wBAAgB,kBAAkB,IAAI,MAAM,CAI3C;AAED,2DAA2D;AAC3D,wBAAgB,UAAU,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAU5F;AAsBD,gFAAgF;AAChF,wBAAsB,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,SAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAGtF;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,SAAI,EAAE,IAAI,SAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CASpH"}

package/dist/vendor/tinbase/cron/service.d.ts

@@ -0,0 +1,47 @@
+/**
+ * In-process scheduler that runs the jobs recorded in cron.job - the execution
+ * half of our pg_cron emulation (the cron.schedule()/unschedule() SQL functions
+ * live in db/emulated.ts). Supports standard 5-field cron expressions and
+ * pg_cron's "N seconds" form. Cron fields are matched in UTC, to match hosted
+ * pg_cron (which runs in UTC). Runs due job commands as superuser and logs each
+ * run to cron.job_run_details.
+ */
+import type { Database } from '../db/database.js';
+/**
+ * Polls cron.job on the tick interval and runs any due jobs as superuser,
+ * logging each run to cron.job_run_details - the execution half of the pg_cron
+ * emulation.
+ */
+export declare class CronService {
+    private db;
+    /** how often to check for due jobs (ms). Small so "N seconds" jobs are timely. */
+    private tickMs;
+    private now;
+    private timer;
+    private lastRun;
+    private lastMinute;
+    /** The in-flight tick, tracked so stop() can drain it before db.close(). */
+    private inFlight;
+    constructor(db: Database, 
+    /** how often to check for due jobs (ms). Small so "N seconds" jobs are timely. */
+    tickMs?: number, now?: () => Date);
+    /** Begin polling for due jobs on the tick interval; no-op if already running. */
+    start(): void;
+    /**
+     * Stop the scheduler and wait for any in-flight tick to finish before the
+     * caller closes the database - the single connection busy-loops if closed
+     * while a job query is still queued.
+     */
+    stop(): Promise<void>;
+    /** Run any due jobs once (also callable directly in tests). */
+    tick(): Promise<void>;
+    private isDue;
+    private run;
+    private log;
+}
+/**
+ * Match a Date against a standard 5-field cron expression (min hour dom month
+ * dow). Fields are evaluated in UTC, matching hosted pg_cron.
+ */
+export declare function cronMatches(expr: string, date: Date): boolean;
+//# sourceMappingURL=service.d.ts.map

package/dist/vendor/tinbase/cron/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/vendor/tinbase/cron/service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAUjD;;;;GAIG;AACH,qBAAa,WAAW;IAQpB,OAAO,CAAC,EAAE;IACV,kFAAkF;IAClF,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,GAAG;IAVb,OAAO,CAAC,KAAK,CAA8C;IAC3D,OAAO,CAAC,OAAO,CAA4B;IAC3C,OAAO,CAAC,UAAU,CAA4B;IAC9C,4EAA4E;IAC5E,OAAO,CAAC,QAAQ,CAA6B;gBAGnC,EAAE,EAAE,QAAQ;IACpB,kFAAkF;IAC1E,MAAM,SAAO,EACb,GAAG,GAAE,MAAM,IAAuB;IAG5C,iFAAiF;IACjF,KAAK,IAAI,IAAI;IAQb;;;;OAIG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAO3B,+DAA+D;IACzD,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAa3B,OAAO,CAAC,KAAK;YAcC,GAAG;YAYH,GAAG;CAWlB;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAe7D"}