@supacloud/lite 0.2.0

package/dist/vendor/tinbase/db/bootstrap.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Idempotent bootstrap SQL that shapes a fresh database like a Supabase
+ * project. Two variants: the full {@link BOOTSTRAP_SQL} for the real engines,
+ * and the reduced {@link MINIMAL_BOOTSTRAP_SQL} below for the pg-mem subset.
+ * Both are safe to re-run (create ... if not exists / create or replace).
+ */
+/**
+ * Reduced bootstrap for subset engines (pg-mem) that can't run plpgsql, RLS
+ * policies, extensions, or LISTEN/NOTIFY. Just the schemas, core tables, and
+ * SQL-language auth helpers needed for the REST + auth CRUD surface. No RLS is
+ * enforced here - this path is for local-dev/preview only.
+ */
+export declare const MINIMAL_BOOTSTRAP_SQL = "\ncreate schema if not exists auth;\ncreate schema if not exists storage;\ncreate schema if not exists supabase_migrations;\n\ncreate table if not exists auth.users (\n  id uuid primary key default gen_random_uuid(),\n  aud text default 'authenticated',\n  role text default 'authenticated',\n  email text unique,\n  encrypted_password text,\n  email_confirmed_at timestamptz,\n  last_sign_in_at timestamptz,\n  raw_app_meta_data jsonb default '{}'::jsonb,\n  raw_user_meta_data jsonb default '{}'::jsonb,\n  is_super_admin boolean default false,\n  created_at timestamptz default now(),\n  updated_at timestamptz default now(),\n  phone text unique,\n  phone_confirmed_at timestamptz,\n  banned_until timestamptz,\n  deleted_at timestamptz,\n  is_anonymous boolean default false\n);\n\ncreate table if not exists auth.refresh_tokens (\n  id bigserial primary key,\n  token text unique not null,\n  user_id uuid not null,\n  parent text,\n  session_id uuid,\n  revoked boolean default false,\n  created_at timestamptz default now(),\n  updated_at timestamptz default now()\n);\n\ncreate table if not exists auth.one_time_tokens (\n  id uuid primary key default gen_random_uuid(),\n  user_id uuid,\n  email text not null,\n  token_type text not null,\n  token text not null,\n  attempts int not null default 0,\n  created_at timestamptz default now(),\n  expires_at timestamptz not null\n);\n\ncreate table if not exists auth.identities (\n  id uuid primary key default gen_random_uuid(),\n  user_id uuid not null,\n  provider text not null,\n  provider_id text not null,\n  identity_data jsonb default '{}'::jsonb,\n  last_sign_in_at timestamptz default now(),\n  created_at timestamptz default now(),\n  updated_at timestamptz default now(),\n  unique (provider, provider_id)\n);\n\ncreate table if not exists auth.flow_state (\n  id uuid primary key default gen_random_uuid(),\n  provider text not null,\n  provider_state text not null unique,\n  redirect_to text,\n  code_challenge text,\n  code_challenge_method text,\n  auth_code text unique,\n  user_id uuid,\n  created_at timestamptz default now(),\n  expires_at timestamptz not null\n);\n\ncreate table if not exists auth.mfa_factors (\n  id uuid primary key default gen_random_uuid(),\n  user_id uuid not null,\n  friendly_name text,\n  factor_type text not null default 'totp',\n  status text not null default 'unverified',\n  secret text,\n  created_at timestamptz default now(),\n  updated_at timestamptz default now()\n);\n\ncreate table if not exists auth.mfa_challenges (\n  id uuid primary key default gen_random_uuid(),\n  factor_id uuid not null,\n  verified_at timestamptz,\n  created_at timestamptz default now(),\n  expires_at timestamptz not null\n);\n\ncreate table if not exists auth.audit_log_entries (\n  id uuid primary key default gen_random_uuid(),\n  payload jsonb,\n  created_at timestamptz default now(),\n  ip_address varchar(64) not null default ''\n);\n\n-- runtime-mutable instance settings (Studio auth toggles)\ncreate table if not exists auth.config (\n  key text primary key,\n  value jsonb not null,\n  updated_at timestamptz default now()\n);\n\ncreate table if not exists storage.buckets (\n  id text primary key,\n  name text not null unique,\n  owner uuid,\n  public boolean default false,\n  file_size_limit bigint,\n  allowed_mime_types text[],\n  created_at timestamptz default now(),\n  updated_at timestamptz default now()\n);\n\ncreate table if not exists storage.objects (\n  id uuid primary key default gen_random_uuid(),\n  bucket_id text not null,\n  name text not null,\n  owner uuid,\n  version text,\n  metadata jsonb default '{}'::jsonb,\n  created_at timestamptz default now(),\n  updated_at timestamptz default now(),\n  last_accessed_at timestamptz default now(),\n  unique (bucket_id, name)\n);\n\ncreate table if not exists supabase_migrations.schema_migrations (\n  version text primary key,\n  name text,\n  statements text[],\n  applied_at timestamptz default now()\n);\n\ncreate table if not exists supabase_migrations.seed_files (\n  path text primary key,\n  hash text,\n  applied_at timestamptz default now()\n);\n";
+/**
+ * Full bootstrap for the real engines (PGlite / native embedded Postgres):
+ * extensions, the anon/authenticated/service_role roles, GoTrue-compatible auth
+ * schema, storage schema with default RLS policies, migration bookkeeping, and
+ * the realtime CDC + broadcast plumbing.
+ */
+export declare const BOOTSTRAP_SQL = "\n-- \u2500\u2500 Extensions \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n-- Supabase enables these by default and migrations lean on them\n-- (uuid_generate_v4(), crypt(), citext, pg_trgm, \u2026). Each is created into the\n-- 'extensions' schema like hosted Supabase; any not available in this engine\n-- build is skipped rather than aborting the whole bootstrap.\ncreate schema if not exists extensions;\ndo $$\ndeclare ext text;\nbegin\n  foreach ext in array array['uuid-ossp','pgcrypto','citext','pg_trgm','ltree','hstore','fuzzystrmatch'] loop\n    begin\n      execute format('create extension if not exists %I with schema extensions', ext);\n    exception when others then\n      -- extension not bundled in this engine build; continue\n    end;\n  end loop;\nend $$;\n\n-- uuid-ossp isn't in every Postgres build (it needs an external UUID lib at\n-- build time - e.g. the theseus Linux binaries omit it). uuid_generate_v4() is\n-- the single most-used function from it, so shim it onto core gen_random_uuid()\n-- (also a v4 UUID) whenever the real extension isn't present, so migrations\n-- that call it work identically on every engine and platform.\ndo $$\nbegin\n  if not exists (\n    select 1 from pg_proc p join pg_namespace n on n.oid = p.pronamespace\n    where p.proname = 'uuid_generate_v4' and n.nspname in ('public', 'extensions')\n  ) then\n    create function extensions.uuid_generate_v4() returns uuid\n      language sql volatile as 'select gen_random_uuid()';\n  end if;\nend $$;\n\n-- Make extension functions resolvable unqualified (uuid_generate_v4(), \u2026) on\n-- the current session (migrations run here) and for future connections.\ndo $$\nbegin\n  execute 'alter database ' || quote_ident(current_database()) ||\n          ' set search_path to \"$user\", public, extensions';\nexception when others then\n  -- some engines disallow altering the current database; session SET below still applies\nend $$;\nset search_path to \"$user\", public, extensions;\n\n-- \u2500\u2500 Roles \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\ndo $$\nbegin\n  if not exists (select from pg_roles where rolname = 'anon') then\n    create role anon nologin noinherit;\n  end if;\n  if not exists (select from pg_roles where rolname = 'authenticated') then\n    create role authenticated nologin noinherit;\n  end if;\n  if not exists (select from pg_roles where rolname = 'service_role') then\n    create role service_role nologin noinherit bypassrls;\n  end if;\nend $$;\n\ngrant usage on schema extensions to anon, authenticated, service_role;\nalter role anon set search_path to \"$user\", public, extensions;\nalter role authenticated set search_path to \"$user\", public, extensions;\nalter role service_role set search_path to \"$user\", public, extensions;\n\ngrant usage on schema public to anon, authenticated, service_role;\ngrant all on all tables in schema public to anon, authenticated, service_role;\ngrant all on all sequences in schema public to anon, authenticated, service_role;\ngrant execute on all functions in schema public to anon, authenticated, service_role;\n\nalter default privileges in schema public\n  grant all on tables to anon, authenticated, service_role;\nalter default privileges in schema public\n  grant all on sequences to anon, authenticated, service_role;\nalter default privileges in schema public\n  grant execute on functions to anon, authenticated, service_role;\n\n-- \u2500\u2500 Auth schema (GoTrue-compatible subset) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\ncreate schema if not exists auth;\n\ncreate table if not exists auth.users (\n  instance_id uuid default '00000000-0000-0000-0000-000000000000',\n  id uuid primary key default gen_random_uuid(),\n  aud text default 'authenticated',\n  role text default 'authenticated',\n  email text unique,\n  encrypted_password text,\n  email_confirmed_at timestamptz,\n  invited_at timestamptz,\n  confirmation_token text default '',\n  confirmation_sent_at timestamptz,\n  recovery_token text default '',\n  recovery_sent_at timestamptz,\n  email_change_token_new text default '',\n  email_change text default '',\n  email_change_sent_at timestamptz,\n  email_change_token_current text default '',\n  email_change_confirm_status smallint default 0,\n  last_sign_in_at timestamptz,\n  raw_app_meta_data jsonb default '{}'::jsonb,\n  raw_user_meta_data jsonb default '{}'::jsonb,\n  is_super_admin boolean default false,\n  created_at timestamptz default now(),\n  updated_at timestamptz default now(),\n  phone text unique,\n  phone_confirmed_at timestamptz,\n  phone_change text default '',\n  phone_change_token text default '',\n  phone_change_sent_at timestamptz,\n  reauthentication_token text default '',\n  reauthentication_sent_at timestamptz,\n  banned_until timestamptz,\n  deleted_at timestamptz,\n  is_anonymous boolean default false\n);\n\ncreate table if not exists auth.refresh_tokens (\n  id bigint generated by default as identity primary key,\n  token text unique not null,\n  user_id uuid not null references auth.users(id) on delete cascade,\n  parent text,\n  session_id uuid,\n  revoked boolean default false,\n  created_at timestamptz default now(),\n  updated_at timestamptz default now()\n);\n\ncreate index if not exists refresh_tokens_user_id_idx on auth.refresh_tokens(user_id);\n\ncreate table if not exists auth.one_time_tokens (\n  id uuid primary key default gen_random_uuid(),\n  user_id uuid references auth.users(id) on delete cascade,\n  email text not null,\n  token_type text not null, -- otp | magiclink | recovery\n  token text not null,\n  attempts int not null default 0,\n  created_at timestamptz default now(),\n  expires_at timestamptz not null\n);\n\ncreate table if not exists auth.identities (\n  id uuid primary key default gen_random_uuid(),\n  user_id uuid not null references auth.users(id) on delete cascade,\n  provider text not null,\n  provider_id text not null,\n  identity_data jsonb default '{}'::jsonb,\n  last_sign_in_at timestamptz default now(),\n  created_at timestamptz default now(),\n  updated_at timestamptz default now(),\n  unique (provider, provider_id)\n);\n\n-- OAuth / PKCE flow state, bridging /authorize \u2192 provider \u2192 /callback \u2192 exchange\ncreate table if not exists auth.flow_state (\n  id uuid primary key default gen_random_uuid(),\n  provider text not null,\n  provider_state text not null unique,\n  redirect_to text,\n  code_challenge text,\n  code_challenge_method text,\n  auth_code text unique,\n  user_id uuid references auth.users(id) on delete cascade,\n  created_at timestamptz default now(),\n  expires_at timestamptz not null\n);\n\ncreate table if not exists auth.mfa_factors (\n  id uuid primary key default gen_random_uuid(),\n  user_id uuid not null references auth.users(id) on delete cascade,\n  friendly_name text,\n  factor_type text not null default 'totp',\n  status text not null default 'unverified', -- unverified | verified\n  secret text,\n  created_at timestamptz default now(),\n  updated_at timestamptz default now()\n);\n\ncreate table if not exists auth.mfa_challenges (\n  id uuid primary key default gen_random_uuid(),\n  factor_id uuid not null references auth.mfa_factors(id) on delete cascade,\n  verified_at timestamptz,\n  created_at timestamptz default now(),\n  expires_at timestamptz not null\n);\n\n-- append-only security audit trail (GoTrue-compatible shape)\ncreate table if not exists auth.audit_log_entries (\n  instance_id uuid default '00000000-0000-0000-0000-000000000000',\n  id uuid primary key default gen_random_uuid(),\n  payload jsonb,\n  created_at timestamptz default now(),\n  ip_address varchar(64) not null default ''\n);\ncreate index if not exists audit_logs_instance_id_idx on auth.audit_log_entries(created_at);\n\n-- runtime-mutable instance settings (Studio auth toggles)\ncreate table if not exists auth.config (\n  key text primary key,\n  value jsonb not null,\n  updated_at timestamptz default now()\n);\n\ngrant usage on schema auth to anon, authenticated, service_role;\n\ncreate or replace function auth.jwt() returns jsonb\nlanguage sql stable as $$\n  select coalesce(\n    nullif(current_setting('request.jwt.claims', true), ''),\n    '{}'\n  )::jsonb\n$$;\n\ncreate or replace function auth.uid() returns uuid\nlanguage sql stable as $$\n  select nullif(auth.jwt() ->> 'sub', '')::uuid\n$$;\n\ncreate or replace function auth.role() returns text\nlanguage sql stable as $$\n  select coalesce(auth.jwt() ->> 'role', 'anon')\n$$;\n\ncreate or replace function auth.email() returns text\nlanguage sql stable as $$\n  select auth.jwt() ->> 'email'\n$$;\n\ngrant execute on function auth.jwt(), auth.uid(), auth.role(), auth.email()\n  to anon, authenticated, service_role;\n\n-- \u2500\u2500 Storage schema (storage-api-compatible subset) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\ncreate schema if not exists storage;\n\ncreate table if not exists storage.buckets (\n  id text primary key,\n  name text not null unique,\n  owner uuid,\n  public boolean default false,\n  file_size_limit bigint,\n  allowed_mime_types text[],\n  created_at timestamptz default now(),\n  updated_at timestamptz default now()\n);\n\ncreate table if not exists storage.objects (\n  id uuid primary key default gen_random_uuid(),\n  bucket_id text not null references storage.buckets(id),\n  name text not null,\n  owner uuid,\n  version text,\n  metadata jsonb default '{}'::jsonb,\n  created_at timestamptz default now(),\n  updated_at timestamptz default now(),\n  last_accessed_at timestamptz default now(),\n  unique (bucket_id, name)\n);\n\ncreate index if not exists objects_bucket_name_idx on storage.objects(bucket_id, name);\n\ngrant usage on schema storage to anon, authenticated, service_role;\ngrant select on storage.buckets to anon, authenticated, service_role;\ngrant all on storage.buckets to service_role;\ngrant all on storage.objects to anon, authenticated, service_role;\n\ncreate or replace function storage.foldername(name text) returns text[]\nlanguage sql immutable as $$\n  select (string_to_array(name, '/'))[1 : array_length(string_to_array(name, '/'), 1) - 1]\n$$;\n\ncreate or replace function storage.filename(name text) returns text\nlanguage sql immutable as $$\n  select (string_to_array(name, '/'))[array_length(string_to_array(name, '/'), 1)]\n$$;\n\ncreate or replace function storage.extension(name text) returns text\nlanguage sql immutable as $$\n  select reverse(split_part(reverse(storage.filename(name)), '.', 1))\n$$;\n\nalter table storage.objects enable row level security;\n\ndrop policy if exists tinbase_authenticated_all on storage.objects;\ndrop policy if exists tinbase_public_read on storage.objects;\n\n-- \u2500\u2500 Migration bookkeeping (same table the Supabase CLI uses) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\ncreate schema if not exists supabase_migrations;\n\ncreate table if not exists supabase_migrations.schema_migrations (\n  version text primary key,\n  name text,\n  statements text[],\n  applied_at timestamptz default now()\n);\n\ncreate table if not exists supabase_migrations.seed_files (\n  path text primary key,\n  hash text,\n  applied_at timestamptz default now()\n);\n\n-- \u2500\u2500 Realtime CDC plumbing \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\ncreate schema if not exists tinbase;\n\ncreate or replace function tinbase.cdc_notify() returns trigger\nlanguage plpgsql security definer as $$\ndeclare\n  payload text;\nbegin\n  payload := json_build_object(\n    'schema', TG_TABLE_SCHEMA,\n    'table', TG_TABLE_NAME,\n    'type', TG_OP,\n    'commit_timestamp', to_char(now() at time zone 'utc', 'YYYY-MM-DD\"T\"HH24:MI:SS.MS\"Z\"'),\n    'record', case when TG_OP in ('INSERT', 'UPDATE') then row_to_json(NEW) else null end,\n    'old_record', case when TG_OP in ('UPDATE', 'DELETE') then row_to_json(OLD) else null end\n  )::text;\n  -- pg_notify payloads are capped at ~8kB; degrade like Supabase does.\n  if octet_length(payload) > 7500 then\n    payload := json_build_object(\n      'schema', TG_TABLE_SCHEMA,\n      'table', TG_TABLE_NAME,\n      'type', TG_OP,\n      'commit_timestamp', to_char(now() at time zone 'utc', 'YYYY-MM-DD\"T\"HH24:MI:SS.MS\"Z\"'),\n      'record', null,\n      'old_record', null,\n      'errors', json_build_array('Payload too large')\n    )::text;\n  end if;\n  perform pg_notify('tinbase_cdc', payload);\n  return coalesce(NEW, OLD);\nend $$;\n\n-- \u2500\u2500 Realtime Authorization + broadcast-from-database \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n-- Mirrors Supabase Realtime: developers write RLS policies on\n-- realtime.messages using realtime.topic(); a SELECT policy grants a private\n-- channel's subscribers the right to *receive*, an INSERT policy the right to\n-- *broadcast*. realtime.send() lets the database push a broadcast to a topic.\ncreate schema if not exists realtime;\n\ncreate table if not exists realtime.messages (\n  id uuid not null default gen_random_uuid(),\n  topic text not null,\n  extension text not null,\n  event text,\n  payload jsonb,\n  private boolean default false,\n  inserted_at timestamptz not null default now(),\n  updated_at timestamptz not null default now(),\n  primary key (id)\n);\nalter table realtime.messages enable row level security;\n\ngrant usage on schema realtime to anon, authenticated, service_role;\ngrant all on realtime.messages to anon, authenticated, service_role;\n\n-- the topic currently being authorized/broadcast (set per operation)\ncreate or replace function realtime.topic() returns text\n  language sql stable as $$ select nullif(current_setting('realtime.topic', true), '') $$;\n\n-- push a broadcast message to all subscribers of <topic> from SQL / triggers.\n-- Delivered over the websocket by the in-process realtime engine, which listens\n-- on the 'tinbase_realtime_broadcast' channel.\ncreate or replace function realtime.send(payload jsonb, event text, topic text, private boolean default true)\n  returns void language plpgsql security definer as $$\nbegin\n  perform pg_notify(\n    'tinbase_realtime_broadcast',\n    json_build_object('topic', topic, 'event', event, 'payload', payload, 'private', private)::text\n  );\nexception when others then\n  -- never let a notify failure abort the caller's transaction\n  null;\nend $$;\n\ngrant execute on function realtime.topic() to anon, authenticated, service_role;\ngrant execute on function realtime.send(jsonb, text, text, boolean) to anon, authenticated, service_role;\n";
+//# sourceMappingURL=bootstrap.d.ts.map

package/dist/vendor/tinbase/db/bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../../../../src/vendor/tinbase/db/bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,4iIA6IjC,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,aAAa,66eAwXzB,CAAA"}

package/dist/vendor/tinbase/db/database.d.ts

@@ -0,0 +1,168 @@
+import type { DbEngine, EngineResults } from './engine.js';
+import type { MigrationFile, RequestContext } from '../types.js';
+/** One column of an introspected table. */
+export interface ColumnInfo {
+    name: string;
+    /** underlying pg type name (pg_type.typname / information_schema.udt_name). */
+    udtName: string;
+    isNullable: boolean;
+    hasDefault: boolean;
+    isPrimaryKey: boolean;
+}
+/** A foreign-key constraint, with source and target columns paired by position. */
+export interface ForeignKey {
+    constraintName: string;
+    srcSchema: string;
+    srcTable: string;
+    srcColumns: string[];
+    tgtSchema: string;
+    tgtTable: string;
+    tgtColumns: string[];
+}
+/** An introspected table: its columns and primary-key column names. */
+export interface TableInfo {
+    schema: string;
+    name: string;
+    columns: ColumnInfo[];
+    primaryKey: string[];
+    /**
+     * Column-sets with a uniqueness guarantee (each PRIMARY KEY / UNIQUE
+     * constraint, columns in definition order). Used to decide embed cardinality:
+     * a foreign key whose columns are a unique key on the referencing side is a
+     * one-to-one relationship (PostgREST serializes it as an object, not array).
+     */
+    uniqueKeys: string[][];
+}
+/** One argument of a database function. */
+export interface FunctionArg {
+    name: string;
+    type: string;
+}
+/** An introspected database function (used to route RPC calls). */
+export interface FunctionInfo {
+    schema: string;
+    name: string;
+    returnsSet: boolean;
+    returnType: string;
+    /** pg_type.typtype: b=base, c=composite, p=pseudo, d=domain, e=enum */
+    returnTypType: string;
+    /** pg_proc.provolatile: v=volatile, s=stable, i=immutable. Volatile calls may run DDL. */
+    volatility: string;
+    args: FunctionArg[];
+}
+/** Introspected shape of one schema: tables keyed by name, plus its foreign keys. */
+export interface SchemaInfo {
+    tables: Map<string, TableInfo>;
+    foreignKeys: ForeignKey[];
+}
+/** A function that runs a parameterized query, e.g. one bound to a transaction. */
+export type Querier = (sql: string, params?: unknown[]) => Promise<EngineResults>;
+/**
+ * A change-data-capture event for one row, shaped like Supabase Realtime's
+ * `postgres_changes` payload. Emitted by the SQL trigger on the real engines
+ * and synthesized in JS on pg-mem (see {@link Database.emitCdc}).
+ */
+export interface CdcEvent {
+    schema: string;
+    table: string;
+    type: 'INSERT' | 'UPDATE' | 'DELETE';
+    commit_timestamp: string;
+    /** post-image; null on DELETE (and on a payload that was too large). */
+    record: Record<string, unknown> | null;
+    /** pre-image; null on INSERT (and on a payload that was too large). */
+    old_record: Record<string, unknown> | null;
+    /** set when the row was dropped from the payload, e.g. 'Payload too large'. */
+    errors?: string[];
+}
+/**
+ * The database facade: wraps a {@link DbEngine} with bootstrap, migration
+ * application, schema introspection (cached), and the realtime CDC pipeline.
+ */
+export declare class Database {
+    engine: DbEngine;
+    private schemaCache;
+    private fnCache;
+    private cdcListeners;
+    private cdcStarted;
+    private constructor();
+    /** Create a Database on PGlite (default) or any custom DbEngine. */
+    static create(dataDirOrEngine?: string | DbEngine, opts?: {
+        vaultKey?: string;
+    }): Promise<Database>;
+    /** Superuser query - used by auth/storage internals and introspection. */
+    query<T = any>(sql: string, params?: unknown[]): Promise<EngineResults<T>>;
+    /** Run one or more SQL statements with no params (superuser). */
+    exec(sql: string): Promise<unknown>;
+    /**
+     * Run `fn` inside a transaction with the request's Postgres role and JWT
+     * claims applied via SET LOCAL - this is what makes RLS behave exactly
+     * like hosted Supabase.
+     */
+    withContext<T>(ctx: RequestContext, fn: (q: Querier) => Promise<T>): Promise<T>;
+    /**
+     * Apply any not-yet-recorded migrations (in lexicographic version order) and
+     * an optional seed, each in its own transaction, then invalidate the schema
+     * cache. Returns the names of what was applied this run.
+     *
+     * @throws whatever a migration throws, except on the pg-mem engine where an
+     *   unsupported migration is skipped with a warning instead of aborting.
+     */
+    runMigrations(migrations: MigrationFile[], seedSql?: string): Promise<string[]>;
+    /** Every migration recorded as applied, oldest version first. */
+    listAppliedMigrations(): Promise<{
+        version: string;
+        name: string | null;
+    }[]>;
+    /** Drop all cached introspection; call after any DDL changes the schema. */
+    invalidateSchemaCache(): void;
+    private rlsCache;
+    /** Names of tables in `schema` that have row-level security enabled. */
+    getRlsTables(schema: string): Promise<Set<string>>;
+    /** Introspect a schema's tables, columns, PKs, and FKs. Cached per schema. */
+    getSchemaInfo(schema: string): Promise<SchemaInfo>;
+    /**
+     * All overloads of a function by schema + name (cached). Multiple rows mean
+     * the name is overloaded on argument types.
+     */
+    getFunctions(schema: string, name: string): Promise<FunctionInfo[]>;
+    /** Idempotently attach the CDC notify trigger to a table (real engines only). */
+    ensureCdcTrigger(schema: string, table: string): Promise<void>;
+    /**
+     * Register a CDC listener; the first call starts the single LISTEN on the
+     * shared `tinbase_cdc` channel. Returns an unsubscribe fn.
+     */
+    onCdcEvent(cb: (e: CdcEvent) => void): Promise<() => void>;
+    /**
+     * True when the engine can't run the trigger + `pg_notify` CDC pipeline
+     * (pg-mem has no triggers/LISTEN/NOTIFY). For those engines the REST layer
+     * synthesizes change events in JS via {@link emitCdc}, since every write goes
+     * through it in-process.
+     */
+    get jsCdc(): boolean;
+    /**
+     * Feed synthetic CDC events into the same listener set the trigger path uses,
+     * so realtime `postgres_changes` and database webhooks fire on engines without
+     * triggers/NOTIFY (pg-mem). Called by the REST handler after a committed
+     * mutation, one event per affected row.
+     *
+     * NOTE: these engines have no RLS, so events are delivered unfiltered - the
+     * per-subscriber row check in the realtime layer is a no-op here.
+     */
+    emitCdc(meta: {
+        schema: string;
+        table: string;
+        type: CdcEvent['type'];
+    }, rows: Record<string, unknown>[]): void;
+    /** Close the underlying engine and its connection. */
+    close(): Promise<void>;
+}
+/** Parse pg_get_function_identity_arguments output: "a integer, b text[]". */
+export declare function parseIdentityArgs(identity: string): FunctionArg[];
+/**
+ * Double-quote an identifier for safe interpolation into SQL.
+ * @throws if the name contains a NUL, which Postgres identifiers can't hold.
+ */
+export declare function quoteIdent(name: string): string;
+/** Single-quote a string literal for safe interpolation into SQL. */
+export declare function quoteLiteral(value: string): string;
+//# sourceMappingURL=database.d.ts.map

package/dist/vendor/tinbase/db/database.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"database.d.ts","sourceRoot":"","sources":["../../../../src/vendor/tinbase/db/database.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAY,MAAM,aAAa,CAAA;AACpE,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAEhE,2CAA2C;AAC3C,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,+EAA+E;IAC/E,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,OAAO,CAAA;IACnB,UAAU,EAAE,OAAO,CAAA;IACnB,YAAY,EAAE,OAAO,CAAA;CACtB;AAED,mFAAmF;AACnF,MAAM,WAAW,UAAU;IACzB,cAAc,EAAE,MAAM,CAAA;IACtB,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,EAAE,CAAA;CACrB;AAED,uEAAuE;AACvE,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,UAAU,EAAE,CAAA;IACrB,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB;;;;;OAKG;IACH,UAAU,EAAE,MAAM,EAAE,EAAE,CAAA;CACvB;AAED,2CAA2C;AAC3C,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;CACb;AAED,mEAAmE;AACnE,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,OAAO,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;IAClB,uEAAuE;IACvE,aAAa,EAAE,MAAM,CAAA;IACrB,0FAA0F;IAC1F,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,WAAW,EAAE,CAAA;CACpB;AAED,qFAAqF;AACrF,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IAC9B,WAAW,EAAE,UAAU,EAAE,CAAA;CAC1B;AAED,mFAAmF;AACnF,MAAM,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,aAAa,CAAC,CAAA;AAEjF;;;;GAIG;AACH,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAA;IACpC,gBAAgB,EAAE,MAAM,CAAA;IACxB,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IACtC,uEAAuE;IACvE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IAC1C,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAClB;AAED;;;GAGG;AACH,qBAAa,QAAQ;IAMQ,MAAM,EAAE,QAAQ;IAL3C,OAAO,CAAC,WAAW,CAAgC;IACnD,OAAO,CAAC,OAAO,CAAoC;IACnD,OAAO,CAAC,YAAY,CAAmC;IACvD,OAAO,CAAC,UAAU,CAAQ;IAE1B,OAAO;IAEP,oEAAoE;WACvD,MAAM,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,QAAQ,EAAE,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;IA0BzG,0EAA0E;IAC1E,KAAK,CAAC,CAAC,GAAG,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IAI1E,iEAAiE;IACjE,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAInC;;;;OAIG;IACG,WAAW,CAAC,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAarF;;;;;;;OAOG;IACG,aAAa,CAAC,UAAU,EAAE,aAAa,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAwErF,iEAAiE;IAC3D,qBAAqB,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EAAE,CAAC;IASlF,4EAA4E;IAC5E,qBAAqB,IAAI,IAAI;IAM7B,OAAO,CAAC,QAAQ,CAAiC;IAEjD,wEAAwE;IAClE,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAcxD,8EAA8E;IACxE,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAuIxD;;;OAGG;IACG,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAqCzE,iFAAiF;IAC3E,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBpE;;;OAGG;IACG,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,KAAK,IAAI,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC;IAgBhE;;;;;OAKG;IACH,IAAI,KAAK,IAAI,OAAO,CAEnB;IAED;;;;;;;;OAQG;IACH,OAAO,CACL,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;KAAE,EAC/D,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAC9B,IAAI;IAeP,sDAAsD;IAChD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B;AAED,8EAA8E;AAC9E,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,EAAE,CAyBjE;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAG/C;AAED,qEAAqE;AACrE,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAElD"}

package/dist/vendor/tinbase/db/emulated.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Pure-SQL emulations of Supabase's queue and cron extensions, so migrations
+ * and app code that call pgmq.* / cron.* work with no C extension on either
+ * engine. pgmq is fully self-contained SQL. cron records jobs here; the
+ * in-process CronService (src/cron/service.ts) executes them.
+ *
+ * These match the real extensions' function signatures closely enough that
+ * `pgmq.send(...)`, `pgmq.read(...)`, `select cron.schedule(...)` etc. behave
+ * the same from the client's and a migration's point of view.
+ */
+/**
+ * Self-contained SQL emulation of the pgmq extension: per-queue `q_<name>` /
+ * `a_<name>` tables plus create/send/read/pop/delete/archive/etc functions,
+ * matching pgmq's signatures. No C extension, no background worker needed.
+ */
+export declare const PGMQ_SQL = "\ncreate schema if not exists pgmq;\ngrant usage on schema pgmq to anon, authenticated, service_role;\n\ndo $$ begin\n  if not exists (select 1 from pg_type t join pg_namespace n on n.oid = t.typnamespace\n                 where t.typname = 'message_record' and n.nspname = 'pgmq') then\n    create type pgmq.message_record as (\n      msg_id bigint, read_ct integer, enqueued_at timestamptz, vt timestamptz, message jsonb\n    );\n  end if;\nend $$;\n\ncreate or replace function pgmq.create(queue_name text) returns void language plpgsql security definer set search_path = pgmq, pg_catalog, public as $pgmq$\nbegin\n  execute format('create table if not exists pgmq.%I (\n    msg_id bigint generated always as identity primary key,\n    read_ct integer not null default 0,\n    enqueued_at timestamptz not null default now(),\n    vt timestamptz not null default now(),\n    message jsonb)', 'q_' || queue_name);\n  execute format('create table if not exists pgmq.%I (\n    msg_id bigint primary key, read_ct integer not null default 0,\n    enqueued_at timestamptz not null, archived_at timestamptz not null default now(),\n    vt timestamptz, message jsonb)', 'a_' || queue_name);\nend $pgmq$;\n\ncreate or replace function pgmq.send(queue_name text, msg jsonb, delay integer default 0)\nreturns bigint language plpgsql security definer set search_path = pgmq, pg_catalog, public as $pgmq$\ndeclare id bigint;\nbegin\n  perform pgmq.create(queue_name);\n  execute format('insert into pgmq.%I (vt, message) values (now() + make_interval(secs => $1), $2) returning msg_id', 'q_' || queue_name)\n    into id using delay, msg;\n  return id;\nend $pgmq$;\n\ncreate or replace function pgmq.read(queue_name text, vt integer, qty integer)\nreturns setof pgmq.message_record language plpgsql security definer set search_path = pgmq, pg_catalog, public as $pgmq$\nbegin\n  return query execute format($fmt$\n    with cte as (\n      select msg_id from pgmq.%I where vt <= now() order by msg_id limit $1 for update skip locked\n    )\n    update pgmq.%I m set vt = now() + make_interval(secs => $2), read_ct = read_ct + 1\n    from cte where m.msg_id = cte.msg_id\n    returning m.msg_id, m.read_ct, m.enqueued_at, m.vt, m.message\n  $fmt$, 'q_' || queue_name, 'q_' || queue_name) using qty, vt;\nend $pgmq$;\n\ncreate or replace function pgmq.pop(queue_name text)\nreturns setof pgmq.message_record language plpgsql security definer set search_path = pgmq, pg_catalog, public as $pgmq$\nbegin\n  return query execute format($fmt$\n    with cte as (select msg_id from pgmq.%I where vt <= now() order by msg_id limit 1 for update skip locked)\n    delete from pgmq.%I m using cte where m.msg_id = cte.msg_id\n    returning m.msg_id, m.read_ct, m.enqueued_at, m.vt, m.message\n  $fmt$, 'q_' || queue_name, 'q_' || queue_name);\nend $pgmq$;\n\ncreate or replace function pgmq.delete(queue_name text, msg_id bigint)\nreturns boolean language plpgsql security definer set search_path = pgmq, pg_catalog, public as $pgmq$\ndeclare n integer;\nbegin\n  execute format('delete from pgmq.%I where msg_id = $1', 'q_' || queue_name) using msg_id;\n  get diagnostics n = row_count;\n  return n > 0;\nend $pgmq$;\n\ncreate or replace function pgmq.archive(queue_name text, msg_id bigint)\nreturns boolean language plpgsql security definer set search_path = pgmq, pg_catalog, public as $pgmq$\ndeclare n integer;\nbegin\n  execute format($fmt$\n    with del as (delete from pgmq.%I where msg_id = $1 returning *)\n    insert into pgmq.%I (msg_id, read_ct, enqueued_at, vt, message)\n    select msg_id, read_ct, enqueued_at, vt, message from del\n  $fmt$, 'q_' || queue_name, 'a_' || queue_name) using msg_id;\n  get diagnostics n = row_count;\n  return n > 0;\nend $pgmq$;\n\ncreate or replace function pgmq.drop_queue(queue_name text) returns boolean language plpgsql security definer set search_path = pgmq, pg_catalog, public as $pgmq$\nbegin\n  execute format('drop table if exists pgmq.%I', 'q_' || queue_name);\n  execute format('drop table if exists pgmq.%I', 'a_' || queue_name);\n  return true;\nend $pgmq$;\n\ncreate or replace function pgmq.purge_queue(queue_name text) returns bigint language plpgsql security definer set search_path = pgmq, pg_catalog, public as $pgmq$\ndeclare n bigint;\nbegin\n  execute format('delete from pgmq.%I', 'q_' || queue_name);\n  get diagnostics n = row_count;\n  return n;\nend $pgmq$;\n\ncreate or replace function pgmq.list_queues()\nreturns table(queue_name text, is_partitioned boolean, is_unlogged boolean, created_at timestamptz)\nlanguage sql security definer set search_path = pgmq, pg_catalog, public as $pgmq$\n  select substring(tablename from 3), false, false, now()\n  from pg_tables where schemaname = 'pgmq' and left(tablename, 2) = 'q_';\n$pgmq$;\n\ngrant execute on all functions in schema pgmq to anon, authenticated, service_role;\n";
+/**
+ * pg_cron emulation: the `cron.job` / `cron.job_run_details` tables and
+ * schedule/unschedule functions. This only records jobs; the in-process
+ * CronService (src/cron/service.ts) reads the table and runs them.
+ */
+export declare const CRON_SQL = "\ncreate schema if not exists cron;\n-- cron.schedule executes arbitrary SQL as the (superuser) function owner, so it\n-- must stay restricted to service_role - matching hosted Supabase, where\n-- authenticated cannot schedule jobs.\ngrant usage on schema cron to service_role;\n\ncreate table if not exists cron.job (\n  jobid bigint generated always as identity primary key,\n  schedule text not null,\n  command text not null,\n  jobname text unique,\n  active boolean not null default true,\n  created_at timestamptz not null default now()\n);\n\ncreate table if not exists cron.job_run_details (\n  runid bigint generated always as identity primary key,\n  jobid bigint,\n  command text,\n  status text,\n  return_message text,\n  start_time timestamptz,\n  end_time timestamptz\n);\n\ncreate or replace function cron.schedule(job_name text, schedule text, command text)\nreturns bigint language plpgsql security definer set search_path = cron, pg_catalog, public as $cron$\ndeclare id bigint;\nbegin\n  insert into cron.job (jobname, schedule, command) values (job_name, schedule, command)\n  on conflict (jobname) do update set schedule = excluded.schedule, command = excluded.command, active = true\n  returning jobid into id;\n  return id;\nend $cron$;\n\ncreate or replace function cron.schedule(schedule text, command text)\nreturns bigint language plpgsql security definer set search_path = cron, pg_catalog, public as $cron$\nbegin\n  return cron.schedule('job_' || floor(extract(epoch from clock_timestamp()) * 1000)::bigint::text, schedule, command);\nend $cron$;\n\ncreate or replace function cron.unschedule(job_name text)\nreturns boolean language plpgsql security definer set search_path = cron, pg_catalog, public as $cron$\ndeclare n integer;\nbegin\n  delete from cron.job where jobname = job_name;\n  get diagnostics n = row_count;\n  return n > 0;\nend $cron$;\n\ncreate or replace function cron.unschedule(job_id bigint)\nreturns boolean language plpgsql security definer set search_path = cron, pg_catalog, public as $cron$\ndeclare n integer;\nbegin\n  delete from cron.job where jobid = job_id;\n  get diagnostics n = row_count;\n  return n > 0;\nend $cron$;\n\ngrant execute on function cron.schedule(text,text,text), cron.schedule(text,text), cron.unschedule(text), cron.unschedule(bigint) to service_role;\n";
+/**
+ * pg_net emulation - the `net.http_get/post/delete` SQL surface. The functions
+ * only enqueue into net.http_request_queue; the in-process NetService
+ * (src/net/service.ts) performs the HTTP and records the reply in
+ * net._http_response, exactly like pg_net's background worker. This lets the
+ * common Supabase pattern - a cron job that calls net.http_post to hit an Edge
+ * Function - run unchanged, with no C extension on either engine.
+ */
+export declare const NET_SQL = "\ncreate schema if not exists net;\n-- net.http_* can reach arbitrary URLs from the server (SSRF surface), so keep it\n-- restricted to service_role like hosted Supabase - not authenticated.\ngrant usage on schema net to service_role;\n\ncreate table if not exists net.http_request_queue (\n  id bigint generated always as identity primary key,\n  method text not null,\n  url text not null,\n  headers jsonb not null default '{}'::jsonb,\n  body text,\n  timeout_milliseconds int not null default 5000,\n  created timestamptz not null default now()\n);\n\ncreate table if not exists net._http_response (\n  id bigint primary key,\n  status_code int,\n  content_type text,\n  headers jsonb,\n  content text,\n  timed_out boolean,\n  error_msg text,\n  created timestamptz not null default now()\n);\ngrant select on net._http_response to service_role;\n\n-- fold a jsonb param object into the URL as a query string (pg_net semantics)\ncreate or replace function net._merge_params(url text, params jsonb)\nreturns text language sql immutable as $net$\n  select case\n    when params is null or params = '{}'::jsonb then url\n    else url || (case when position('?' in url) > 0 then '&' else '?' end) ||\n      (select string_agg(key || '=' || (value #>> '{}'), '&') from jsonb_each(params))\n  end;\n$net$;\n\ncreate or replace function net.http_get(url text, params jsonb default '{}'::jsonb, headers jsonb default '{}'::jsonb, timeout_milliseconds int default 5000)\nreturns bigint language plpgsql security definer set search_path = net, pg_catalog, public as $net$\ndeclare req_id bigint;\nbegin\n  insert into net.http_request_queue (method, url, headers, body, timeout_milliseconds)\n  values ('GET', net._merge_params(url, params), coalesce(headers, '{}'::jsonb), null, timeout_milliseconds)\n  returning id into req_id;\n  return req_id;\nend $net$;\n\ncreate or replace function net.http_post(url text, body jsonb default '{}'::jsonb, params jsonb default '{}'::jsonb, headers jsonb default '{}'::jsonb, timeout_milliseconds int default 5000)\nreturns bigint language plpgsql security definer set search_path = net, pg_catalog, public as $net$\ndeclare req_id bigint; hdrs jsonb;\nbegin\n  hdrs := coalesce(headers, '{}'::jsonb);\n  -- default the content type to JSON, matching pg_net, unless the caller set one\n  if not (hdrs ? 'Content-Type' or hdrs ? 'content-type') then\n    hdrs := hdrs || jsonb_build_object('Content-Type', 'application/json');\n  end if;\n  insert into net.http_request_queue (method, url, headers, body, timeout_milliseconds)\n  values ('POST', net._merge_params(url, params), hdrs, body::text, timeout_milliseconds)\n  returning id into req_id;\n  return req_id;\nend $net$;\n\ncreate or replace function net.http_delete(url text, params jsonb default '{}'::jsonb, headers jsonb default '{}'::jsonb, timeout_milliseconds int default 5000)\nreturns bigint language plpgsql security definer set search_path = net, pg_catalog, public as $net$\ndeclare req_id bigint;\nbegin\n  insert into net.http_request_queue (method, url, headers, body, timeout_milliseconds)\n  values ('DELETE', net._merge_params(url, params), coalesce(headers, '{}'::jsonb), null, timeout_milliseconds)\n  returning id into req_id;\n  return req_id;\nend $net$;\n\ngrant execute on function net.http_get(text,jsonb,jsonb,int), net.http_post(text,jsonb,jsonb,jsonb,int), net.http_delete(text,jsonb,jsonb,int) to service_role;\n";
+/**
+ * Small pure-SQL stand-ins for contrib extensions Supabase migrations lean on
+ * but which aren't in the PGlite / native builds. `moddatetime` (a BEFORE
+ * UPDATE trigger that stamps a timestamp column) is the common one - projects
+ * attach it as the updated_at trigger. Created only if absent, so a real
+ * extension (where present) still wins.
+ */
+export declare const EXT_COMPAT_SQL = "\ncreate schema if not exists extensions;\ndo $ensure_moddatetime$\nbegin\n  if not exists (\n    select 1 from pg_proc p join pg_namespace n on n.oid = p.pronamespace\n    where n.nspname = 'extensions' and p.proname = 'moddatetime'\n  ) then\n    execute $fn$\n      create function extensions.moddatetime() returns trigger language plpgsql as $mod$\n      begin\n        if TG_NARGS >= 1 then\n          NEW := jsonb_populate_record(NEW, jsonb_build_object(TG_ARGV[0], now()));\n        end if;\n        return NEW;\n      end\n      $mod$\n    $fn$;\n  end if;\nend\n$ensure_moddatetime$;\n";
+/**
+ * Supabase Vault emulation. Real Vault (supabase_vault + pgsodium) encrypts
+ * secrets at rest; we can't ship those C extensions. This stand-in keeps the
+ * same surface (vault.secrets, vault.decrypted_secrets, vault.create_secret /
+ * update_secret) but stores the secret encrypted with pgcrypto's authenticated
+ * symmetric encryption (pgp_sym_encrypt) under a key held in the GUC
+ * app.settings.vault_key, set at boot and never stored in the database.
+ *
+ * SECURITY: the stored `secret` column holds ciphertext; decrypted_secrets
+ * decrypts on read. If pgcrypto or the key is unavailable the functions raise,
+ * rather than silently falling back to cleartext.
+ */
+export declare const VAULT_SQL = "\ncreate schema if not exists vault;\ngrant usage on schema vault to service_role;\n\ncreate table if not exists vault.secrets (\n  id uuid primary key default gen_random_uuid(),\n  name text unique,\n  description text not null default '',\n  secret text not null,\n  key_id uuid,\n  nonce bytea,\n  created_at timestamptz not null default now(),\n  updated_at timestamptz not null default now()\n);\ngrant select, insert, update, delete on vault.secrets to service_role;\n\n-- the encryption key, from the GUC set at boot (empty string if unset)\ncreate or replace function vault._key() returns text\nlanguage sql stable as $vault$\n  select coalesce(nullif(current_setting('app.settings.vault_key', true), ''), '')\n$vault$;\n\ncreate or replace function vault._encrypt(plain text) returns text\nlanguage plpgsql security definer set search_path = vault, extensions, pg_catalog, public as $vault$\ndeclare k text := vault._key();\nbegin\n  if plain is null then return null; end if;\n  if k = '' then raise exception 'vault key is not configured'; end if;\n  return encode(pgp_sym_encrypt(plain, k), 'base64');\nend $vault$;\n\ncreate or replace function vault._decrypt(cipher text) returns text\nlanguage plpgsql security definer set search_path = vault, extensions, pg_catalog, public as $vault$\ndeclare k text := vault._key();\nbegin\n  if cipher is null then return null; end if;\n  if k = '' then raise exception 'vault key is not configured'; end if;\n  return pgp_sym_decrypt(decode(cipher, 'base64'), k);\nend $vault$;\n\ncreate or replace view vault.decrypted_secrets as\n  select id, name, description, secret, vault._decrypt(secret) as decrypted_secret, key_id, nonce, created_at, updated_at\n  from vault.secrets;\ngrant select on vault.decrypted_secrets to service_role;\n\ncreate or replace function vault.create_secret(new_secret text, new_name text default null, new_description text default '', new_key_id uuid default null)\nreturns uuid language plpgsql security definer set search_path = vault, pg_catalog, public as $vault$\ndeclare rec_id uuid;\nbegin\n  insert into vault.secrets (name, description, secret, key_id)\n  values (new_name, coalesce(new_description, ''), vault._encrypt(new_secret), new_key_id)\n  returning id into rec_id;\n  return rec_id;\nend $vault$;\n\ncreate or replace function vault.update_secret(secret_id uuid, new_secret text default null, new_name text default null, new_description text default null, new_key_id uuid default null)\nreturns void language plpgsql security definer set search_path = vault, pg_catalog, public as $vault$\nbegin\n  update vault.secrets set\n    secret = case when new_secret is null then secret else vault._encrypt(new_secret) end,\n    name = coalesce(new_name, name),\n    description = coalesce(new_description, description),\n    key_id = coalesce(new_key_id, key_id),\n    updated_at = now()\n  where id = secret_id;\nend $vault$;\n\ngrant execute on function vault.create_secret(text,text,text,uuid), vault.update_secret(uuid,text,text,text,uuid) to service_role;\n";
+//# sourceMappingURL=emulated.d.ts.map

package/dist/vendor/tinbase/db/emulated.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"emulated.d.ts","sourceRoot":"","sources":["../../../../src/vendor/tinbase/db/emulated.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH;;;;GAIG;AACH,eAAO,MAAM,QAAQ,ixJAyGpB,CAAA;AAID;;;;GAIG;AACH,eAAO,MAAM,QAAQ,uyEA6DpB,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,OAAO,82GA0EnB,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,ulBAqB1B,CAAA;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,SAAS,m/FAoErB,CAAA"}

package/dist/vendor/tinbase/db/engine.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Database engine abstraction. Two implementations:
+ *  - PGlite (WASM Postgres): portable, runs in the browser; heavier RAM.
+ *  - Native embedded Postgres (Node only): PocketBase-class footprint.
+ * The rest of tinbase only talks to this interface.
+ */
+/** Result of a query: returned rows plus, for writes, the affected row count. */
+export interface EngineResults<T = any> {
+    /** result rows, typed as `T` */
+    rows: T[];
+    /** rows touched by an INSERT/UPDATE/DELETE; undefined for plain SELECTs */
+    affectedRows?: number;
+}
+/** Handle passed to a transaction callback; scoped to the open transaction. */
+export interface EngineTx {
+    /** run a parameterized query within the transaction */
+    query<T = any>(sql: string, params?: unknown[]): Promise<EngineResults<T>>;
+    /** run one or more statements within the transaction (no params) */
+    exec(sql: string): Promise<void>;
+}
+/**
+ * The single database interface the rest of tinbase talks to, regardless of
+ * whether it's backed by PGlite, native embedded Postgres, or the pg-mem subset.
+ */
+export interface DbEngine {
+    /** true for subset engines (pg-mem) that can't run the full plpgsql/RLS bootstrap */
+    minimalBootstrap?: boolean;
+    /** run a parameterized query */
+    query<T = any>(sql: string, params?: unknown[]): Promise<EngineResults<T>>;
+    /** run multiple SQL statements (no params) */
+    exec(sql: string): Promise<void>;
+    /** serialized transaction; implementations must guarantee mutual exclusion */
+    transaction<T>(fn: (tx: EngineTx) => Promise<T>): Promise<T>;
+    /** subscribe to pg_notify on a channel; returns an unsubscribe function */
+    listen(channel: string, cb: (payload: string) => void): Promise<() => void>;
+    /** close the underlying connection/instance */
+    close(): Promise<void>;
+}
+/** Simple async mutex for engines that serialize over one connection. */
+export declare class Mutex {
+    private tail;
+    /** Acquire the lock; await the returned release fn's turn, then call it to free it. */
+    lock(): Promise<() => void>;
+    /** Run `fn` while holding the lock; releases even if `fn` throws. */
+    run<T>(fn: () => Promise<T>): Promise<T>;
+}
+//# sourceMappingURL=engine.d.ts.map

package/dist/vendor/tinbase/db/engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../../../src/vendor/tinbase/db/engine.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,iFAAiF;AACjF,MAAM,WAAW,aAAa,CAAC,CAAC,GAAG,GAAG;IACpC,gCAAgC;IAChC,IAAI,EAAE,CAAC,EAAE,CAAA;IACT,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,+EAA+E;AAC/E,MAAM,WAAW,QAAQ;IACvB,uDAAuD;IACvD,KAAK,CAAC,CAAC,GAAG,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1E,oEAAoE;IACpE,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACjC;AAED;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB,qFAAqF;IACrF,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,gCAAgC;IAChC,KAAK,CAAC,CAAC,GAAG,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1E,8CAA8C;IAC9C,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAChC,8EAA8E;IAC9E,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IAC5D,2EAA2E;IAC3E,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CAAA;IAC3E,+CAA+C;IAC/C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACvB;AAED,yEAAyE;AACzE,qBAAa,KAAK;IAChB,OAAO,CAAC,IAAI,CAAmC;IAE/C,uFAAuF;IACjF,IAAI,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC;IASjC,qEAAqE;IAC/D,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;CAQ/C"}

package/dist/vendor/tinbase/db/inspect.d.ts

@@ -0,0 +1,19 @@
+/**
+ * `tinbase inspect` core: a lightweight database report - per-table row counts
+ * and on-disk size for a schema. Like a tiny `supabase inspect db`, enough to
+ * eyeball what's in a local project. (Uses pg_total_relation_size, so it runs
+ * on the real-Postgres engines, not the pg-mem subset.)
+ */
+import { type Database } from './database.js';
+/** One row of the inspect report: a table with its row count and on-disk size. */
+export interface TableInfo {
+    /** table name (unqualified) */
+    table: string;
+    /** live row count from count(*) */
+    rows: number;
+    /** human-readable total relation size (pg_size_pretty) */
+    size: string;
+}
+/** Report per-table row counts and on-disk sizes for a schema, largest first. */
+export declare function inspectDb(db: Database, schema?: string): Promise<TableInfo[]>;
+//# sourceMappingURL=inspect.d.ts.map

package/dist/vendor/tinbase/db/inspect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inspect.d.ts","sourceRoot":"","sources":["../../../../src/vendor/tinbase/db/inspect.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAc,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAA;AAEzD,kFAAkF;AAClF,MAAM,WAAW,SAAS;IACxB,+BAA+B;IAC/B,KAAK,EAAE,MAAM,CAAA;IACb,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAA;IACZ,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAA;CACb;AAED,iFAAiF;AACjF,wBAAsB,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,SAAW,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAkBrF"}

package/dist/vendor/tinbase/db/pglite-engine.d.ts

@@ -0,0 +1,9 @@
+import type { DbEngine } from './engine.js';
+/**
+ * Build a {@link DbEngine} backed by PGlite (WASM Postgres) at `dataDir`, or an
+ * in-memory database when `dataDir` is omitted. Loads the bundled contrib
+ * extensions Supabase enables by default.
+ * @throws if the PGlite WASM bundle isn't available in this build (use the native engine instead).
+ */
+export declare function createPgliteEngine(dataDir?: string): Promise<DbEngine>;
+//# sourceMappingURL=pglite-engine.d.ts.map

package/dist/vendor/tinbase/db/pglite-engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pglite-engine.d.ts","sourceRoot":"","sources":["../../../../src/vendor/tinbase/db/pglite-engine.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAA2B,MAAM,aAAa,CAAA;AAEpE;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAkE5E"}

package/dist/vendor/tinbase/db/schema-diff.d.ts

@@ -0,0 +1,32 @@
+import type { Database } from './database.js';
+interface ColumnSnap {
+    name: string;
+    /** fully-specified type from format_type (e.g. `character varying(255)`) */
+    type: string;
+    nullable: boolean;
+    /** column default expression, or null when none */
+    default: string | null;
+}
+interface TableSnap {
+    name: string;
+    columns: Map<string, ColumnSnap>;
+    /** column names in declaration order, so DDL is emitted deterministically */
+    order: string[];
+}
+/** A structured snapshot of one schema, diffable into DDL by {@link diffSchemas}. */
+export interface SchemaSnapshot {
+    /** table name → its columns */
+    tables: Map<string, TableSnap>;
+    /** table → (constraint name → definition from pg_get_constraintdef) */
+    constraints: Map<string, Map<string, string>>;
+    /** table → (index name → definition from pg_get_indexdef), excluding constraint-backing indexes */
+    indexes: Map<string, Map<string, string>>;
+    /** enum type name → its labels in sort order */
+    enums: Map<string, string[]>;
+}
+/** Snapshot a schema's tables, columns, constraints, indexes, and enums. */
+export declare function snapshotSchema(db: Database, schema?: string): Promise<SchemaSnapshot>;
+/** DDL to turn `from` into `to`, scoped to one schema. Empty array = no changes. */
+export declare function diffSchemas(from: SchemaSnapshot, to: SchemaSnapshot, schema?: string): string[];
+export {};
+//# sourceMappingURL=schema-diff.d.ts.map

package/dist/vendor/tinbase/db/schema-diff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-diff.d.ts","sourceRoot":"","sources":["../../../../src/vendor/tinbase/db/schema-diff.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAE7C,UAAU,UAAU;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,OAAO,CAAA;IACjB,mDAAmD;IACnD,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CACvB;AACD,UAAU,SAAS;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;IAChC,6EAA6E;IAC7E,KAAK,EAAE,MAAM,EAAE,CAAA;CAChB;AAED,qFAAqF;AACrF,MAAM,WAAW,cAAc;IAC7B,+BAA+B;IAC/B,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IAC9B,uEAAuE;IACvE,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAC7C,mGAAmG;IACnG,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACzC,gDAAgD;IAChD,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;CAC7B;AAED,4EAA4E;AAC5E,wBAAsB,cAAc,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,SAAW,GAAG,OAAO,CAAC,cAAc,CAAC,CAqE7F;AAED,oFAAoF;AACpF,wBAAgB,WAAW,CAAC,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,cAAc,EAAE,MAAM,SAAW,GAAG,MAAM,EAAE,CAiFjG"}

package/dist/vendor/tinbase/db/sql-compat.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Compatibility rewrites for user migration / seed SQL.
+ *
+ * tinbase can't install C extensions (pg_cron, pg_net, http, supabase_vault,
+ * hypopg, …) into the PGlite or embedded-native Postgres build, and several of
+ * them are emulated in pure SQL instead (cron, pg_net, pgmq - see
+ * db/emulated.ts). A real Supabase project's first migration typically runs a
+ * batch of `CREATE EXTENSION` statements; on stock Postgres a missing one
+ * aborts the whole migration with `extension "…" is not available`.
+ *
+ * `tolerateExtensionStatements` wraps every *top-level* CREATE/DROP EXTENSION
+ * statement in a `DO … EXCEPTION WHEN OTHERS` block (the same trick the
+ * bootstrap uses for its own extension list), so an unavailable extension is
+ * skipped with a NOTICE rather than aborting the migration. Extensions the
+ * engine does bundle are still created normally, and the emulated schemas
+ * created at bootstrap remain in place.
+ *
+ * It also strips `CONCURRENTLY` from index statements: tinbase applies each
+ * migration inside a transaction (for atomicity + rollback), and
+ * `CREATE/DROP INDEX CONCURRENTLY` / `REINDEX … CONCURRENTLY` are illegal in a
+ * transaction block. On a single-connection local dev database CONCURRENTLY
+ * buys nothing over a plain index, so we drop the keyword - the resulting index
+ * is identical.
+ *
+ * The scan is quote/comment-aware so it never touches these keywords when they
+ * appear inside a dollar-quoted function body, a string literal, or a comment.
+ */
+/**
+ * Rewrite user migration / seed SQL for the local engine: make CREATE/DROP
+ * EXTENSION tolerant, and strip CONCURRENTLY from index statements.
+ */
+export declare function rewriteMigrationSql(sql: string): string;
+//# sourceMappingURL=sql-compat.d.ts.map

package/dist/vendor/tinbase/db/sql-compat.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-compat.d.ts","sourceRoot":"","sources":["../../../../src/vendor/tinbase/db/sql-compat.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CA0EvD"}

package/dist/vendor/tinbase/functions/deno-shim.d.ts

@@ -0,0 +1,15 @@
+type DenoHandler = (req: Request) => Response | Promise<Response>;
+/**
+ * Run `fn` with the shim's Deno.env bound to `env`. The binding lives in an
+ * async-context store, so concurrent invocations each read their own env and
+ * one backend can never observe another's (or the host's) secrets.
+ */
+export declare function runWithDenoEnv<T>(env: Record<string, string>, fn: () => Promise<T>): Promise<T>;
+/** Install globalThis.Deno if we're not already running under a Deno-like runtime. */
+export declare function installDenoShim(): void;
+/** Return and clear the handler captured by the most recent Deno.serve() call. */
+export declare function takeCapturedHandler(): DenoHandler | undefined;
+/** Clear any handler captured by Deno.serve(), without returning it. */
+export declare function resetCapturedHandler(): void;
+export {};
+//# sourceMappingURL=deno-shim.d.ts.map

package/dist/vendor/tinbase/functions/deno-shim.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deno-shim.d.ts","sourceRoot":"","sources":["../../../../src/vendor/tinbase/functions/deno-shim.ts"],"names":[],"mappings":"AAkBA,KAAK,WAAW,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;AAYjE;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAE/F;AAED,sFAAsF;AACtF,wBAAgB,eAAe,IAAI,IAAI,CAqCtC;AAED,kFAAkF;AAClF,wBAAgB,mBAAmB,IAAI,WAAW,GAAG,SAAS,CAI7D;AAED,wEAAwE;AACxE,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C"}

package/dist/vendor/tinbase/functions/handler.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Edge Functions (/functions/v1/*) - supabase.functions.invoke() support.
+ *
+ * A "function" is any fetch handler: (Request) => Response | Promise<Response>.
+ * The core takes a name → handler map (portable, works in the browser); the
+ * Node CLI populates it from supabase/functions/<name>/index.{ts,js,mjs}
+ * modules that `export default` a fetch handler.
+ */
+import type { RequestContext } from '../types.js';
+/** An edge function: a fetch handler invoked with the resolved request context. */
+export type EdgeFunction = (req: Request, ctx: FunctionContext) => Response | Promise<Response>;
+/** Second argument passed to every {@link EdgeFunction} invocation. */
+export interface FunctionContext {
+    /** verified request context (role + JWT claims) resolved by the router */
+    auth: RequestContext;
+    /** keys/urls so the function can create its own supabase-js client, plus any secrets loaded from supabase/functions/.env */
+    env: {
+        SUPABASE_URL: string;
+        SUPABASE_ANON_KEY: string;
+        SUPABASE_SERVICE_ROLE_KEY: string;
+        [key: string]: string;
+    };
+}
+/** Registry and dispatcher for edge functions, backing supabase.functions.invoke(). */
+export declare class FunctionsHandler {
+    private functions;
+    private env;
+    constructor(functions: Map<string, EdgeFunction>, env: FunctionContext['env']);
+    /** Register (or replace) a function under `name`, served at /functions/v1/<name>. */
+    register(name: string, fn: EdgeFunction): void;
+    /** Names of all registered functions. */
+    list(): string[];
+    /** Dispatch a /functions/v1/<name> request to its handler, returning a 404 when unknown and a 500 when the handler throws or returns a non-Response. */
+    handle(req: Request, ctx: RequestContext, url: URL): Promise<Response>;
+}
+//# sourceMappingURL=handler.d.ts.map

package/dist/vendor/tinbase/functions/handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../../src/vendor/tinbase/functions/handler.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAGjD,mFAAmF;AACnF,MAAM,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,eAAe,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;AAE/F,uEAAuE;AACvE,MAAM,WAAW,eAAe;IAC9B,0EAA0E;IAC1E,IAAI,EAAE,cAAc,CAAA;IACpB,4HAA4H;IAC5H,GAAG,EAAE;QACH,YAAY,EAAE,MAAM,CAAA;QACpB,iBAAiB,EAAE,MAAM,CAAA;QACzB,yBAAyB,EAAE,MAAM,CAAA;QACjC,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;KACtB,CAAA;CACF;AAED,uFAAuF;AACvF,qBAAa,gBAAgB;IAEzB,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,GAAG;gBADH,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,EACpC,GAAG,EAAE,eAAe,CAAC,KAAK,CAAC;IAGrC,qFAAqF;IACrF,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,YAAY,GAAG,IAAI;IAI9C,yCAAyC;IACzC,IAAI,IAAI,MAAM,EAAE;IAIhB,wJAAwJ;IAClJ,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;CAuB7E"}

package/dist/vendor/tinbase/gen-types.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Generate a Supabase-shaped `Database` TypeScript type from the live schema,
+ * matching `supabase gen types typescript` closely enough that a typed
+ * supabase-js client works unchanged:
+ *
+ *   export type Database = {
+ *     public: {
+ *       Tables: { <t>: { Row, Insert, Update, Relationships } }
+ *       Views:  { <v>: { Row } }
+ *       Functions: { <f>: { Args, Returns } }
+ *       Enums:  { <e>: "a" | "b" }
+ *       CompositeTypes: {}
+ *     }
+ *   }
+ */
+import { type Database } from './db/database.js';
+/**
+ * Emit the `Database` type source (see module header) for one schema of the
+ * live database. Reads columns, enums, functions, and foreign keys, then formats
+ * them into the Supabase-shaped type text ready to write to a .d.ts.
+ */
+export declare function generateTypes(db: Database, schema?: string): Promise<string>;
+//# sourceMappingURL=gen-types.d.ts.map

package/dist/vendor/tinbase/gen-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gen-types.d.ts","sourceRoot":"","sources":["../../../src/vendor/tinbase/gen-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAqB,KAAK,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AA2BnE;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,SAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CA4HpF"}