@supacloud/lite 0.2.0

package/dist/vendor/tinbase/index.d.ts

@@ -0,0 +1,82 @@
+import { InboxMailer } from './auth/inbox.js';
+import { LogBuffer } from './log-buffer.js';
+import { FunctionsHandler } from './functions/handler.js';
+import { Database } from './db/database.js';
+import { RealtimeEngine } from './realtime/engine.js';
+import { WebhooksService } from './webhooks/service.js';
+import { CronService } from './cron/service.js';
+import { NetService } from './net/service.js';
+import { RetentionService } from './retention/service.js';
+import type { BackendConfig, MigrationFile } from './types.js';
+export * from './types.js';
+export { Database } from './db/database.js';
+export { createPgliteEngine } from './db/pglite-engine.js';
+export { MemoryStorageDriver } from './storage/driver.js';
+export { InboxMailer, type InboxEntry } from './auth/inbox.js';
+export { LogBuffer, type LogEntry, type LogLevel } from './log-buffer.js';
+export { RealtimeEngine, type RealtimeSocketLike } from './realtime/engine.js';
+export { signJwt, verifyJwt, decodeJwt } from './jwt.js';
+export { FunctionsHandler, type EdgeFunction, type FunctionContext } from './functions/handler.js';
+export { generateTypes } from './gen-types.js';
+export { installDenoShim } from './functions/deno-shim.js';
+export { WebhooksService, type WebhookConfig, type WebhookDelivery } from './webhooks/service.js';
+export { CronService, cronMatches } from './cron/service.js';
+export { NetService, type NetDelivery } from './net/service.js';
+export { RetentionService, type RetentionConfig } from './retention/service.js';
+export { snapshotSchema, diffSchemas, type SchemaSnapshot } from './db/schema-diff.js';
+export { inspectDb, type TableInfo } from './db/inspect.js';
+/**
+ * A running tinbase backend. The one field a consumer always needs is
+ * {@link TinbaseBackend.fetch}; the rest expose the underlying services for
+ * advanced/embedded use (in-process realtime, manual migrations, log access).
+ * Returned by {@link createBackend}.
+ */
+export interface TinbaseBackend {
+    /** The whole backend as a fetch handler. Pass to supabase-js as global.fetch for in-process use. */
+    fetch: typeof fetch;
+    /** The database engine wrapper - run raw SQL, inspect schema, apply migrations. */
+    db: Database;
+    /** Realtime (Postgres CDC → WebSocket) engine backing supabase.channel(). */
+    realtime: RealtimeEngine;
+    /** Edge-function registry/dispatcher backing supabase.functions.invoke(). */
+    functions: FunctionsHandler;
+    /** Database-webhook service (HTTP requests fired on row changes). */
+    webhooks: WebhooksService;
+    /** pg_cron emulation scheduler. */
+    cron: CronService;
+    /** pg_net emulation sender (net.http_* queue drain). */
+    net: NetService;
+    /** Background sweeper that purges expired tokens and aged-out audit rows. */
+    retention: RetentionService;
+    /** JWT for the anon role - use as supabase-js's supabaseKey. */
+    anonKey: string;
+    /** JWT for the service_role - bypasses RLS. */
+    serviceRoleKey: string;
+    /** Secret used to sign/verify every JWT (the resolved value, incl. the default). */
+    jwtSecret: string;
+    /** Recent server logs (also surfaced in the Studio Logs pane). */
+    logs: LogBuffer;
+    /** Captured dev email inbox mounted only on loopback, or null when disabled or replaced. */
+    inbox: InboxMailer | null;
+    /** Apply additional migrations at runtime. */
+    migrate: (migrations: MigrationFile[], seedSql?: string) => Promise<string[]>;
+    /** Tear down every background service and close the database. Idempotent-safe to await once. */
+    close: () => Promise<void>;
+}
+/**
+ * Build a running tinbase backend from {@link BackendConfig}. Wires the
+ * database, auth, storage, realtime, edge functions, and the background
+ * services (webhooks/cron/net/retention), mints the anon/service_role keys, and
+ * returns a {@link TinbaseBackend} whose `fetch` handles every Supabase wire
+ * route.
+ *
+ * All config is optional: with an empty config it boots an in-memory PGlite
+ * backend on the Supabase local-dev defaults. If any startup step throws (e.g. a
+ * failing migration), every handle opened so far is torn down before the error
+ * propagates, so a failed construction never leaks the engine or a timer.
+ *
+ * @throws Error from {@link assertSecretsSafe} when bound to a network-exposed
+ *   host with a weak/default JWT secret or a derived vault key.
+ */
+export declare function createBackend(config?: BackendConfig): Promise<TinbaseBackend>;
+//# sourceMappingURL=index.d.ts.map

package/dist/vendor/tinbase/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/vendor/tinbase/index.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,gBAAgB,EAAqB,MAAM,wBAAwB,CAAA;AAE5E,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAE3C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAIrD,OAAO,EAAE,eAAe,EAAwB,MAAM,uBAAuB,CAAA;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,UAAU,EAAoB,MAAM,kBAAkB,CAAA;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,KAAK,EAAE,aAAa,EAAU,aAAa,EAAkB,MAAM,YAAY,CAAA;AAGtF,cAAc,YAAY,CAAA;AAC1B,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AACzD,OAAO,EAAE,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC9D,OAAO,EAAE,SAAS,EAAE,KAAK,QAAQ,EAAE,KAAK,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AACzE,OAAO,EAAE,cAAc,EAAE,KAAK,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AACxD,OAAO,EAAE,gBAAgB,EAAE,KAAK,YAAY,EAAE,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAClG,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AAC1D,OAAO,EAAE,eAAe,EAAE,KAAK,aAAa,EAAE,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACjG,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC5D,OAAO,EAAE,UAAU,EAAE,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC/D,OAAO,EAAE,gBAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC/E,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,KAAK,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACtF,OAAO,EAAE,SAAS,EAAE,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAE3D;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,oGAAoG;IACpG,KAAK,EAAE,OAAO,KAAK,CAAA;IACnB,mFAAmF;IACnF,EAAE,EAAE,QAAQ,CAAA;IACZ,6EAA6E;IAC7E,QAAQ,EAAE,cAAc,CAAA;IACxB,6EAA6E;IAC7E,SAAS,EAAE,gBAAgB,CAAA;IAC3B,qEAAqE;IACrE,QAAQ,EAAE,eAAe,CAAA;IACzB,mCAAmC;IACnC,IAAI,EAAE,WAAW,CAAA;IACjB,wDAAwD;IACxD,GAAG,EAAE,UAAU,CAAA;IACf,6EAA6E;IAC7E,SAAS,EAAE,gBAAgB,CAAA;IAC3B,gEAAgE;IAChE,OAAO,EAAE,MAAM,CAAA;IACf,+CAA+C;IAC/C,cAAc,EAAE,MAAM,CAAA;IACtB,oFAAoF;IACpF,SAAS,EAAE,MAAM,CAAA;IACjB,kEAAkE;IAClE,IAAI,EAAE,SAAS,CAAA;IACf,4FAA4F;IAC5F,KAAK,EAAE,WAAW,GAAG,IAAI,CAAA;IACzB,8CAA8C;IAC9C,OAAO,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IAC7E,gGAAgG;IAChG,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3B;AAWD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,aAAa,CAAC,MAAM,GAAE,aAAkB,GAAG,OAAO,CAAC,cAAc,CAAC,CA6VvF"}

package/dist/vendor/tinbase/jwt.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Minimal HS256 JWT implementation on WebCrypto.
+ * Works in Node (>=18) and browsers - no dependencies.
+ */
+/** Standard + Supabase/GoTrue claims carried in an access token. Open-ended: any extra claims are preserved. */
+export interface JwtClaims {
+    [key: string]: unknown;
+    sub?: string;
+    role?: string;
+    exp?: number;
+    iat?: number;
+    iss?: string;
+    aud?: string;
+    email?: string;
+    /** authenticator assurance level: 'aal1' (single-factor) or 'aal2' (MFA-verified) */
+    aal?: string;
+    /** authentication methods references, e.g. [{ method: 'password' | 'totp', timestamp }] */
+    amr?: {
+        method: string;
+        timestamp: number;
+    }[];
+}
+/** Sign claims as an HS256 JWT. */
+export declare function signJwt(claims: JwtClaims, secret: string): Promise<string>;
+/** Verifies signature and expiry. Returns claims, or null when invalid. */
+export declare function verifyJwt(token: string, secret: string): Promise<JwtClaims | null>;
+/** Decode without verification (for introspection/debugging only). */
+export declare function decodeJwt(token: string): JwtClaims | null;
+/** A URL-safe random token (base64url of `bytes` CSPRNG bytes). Used for refresh/one-time/link tokens. */
+export declare function randomToken(bytes?: number): string;
+//# sourceMappingURL=jwt.d.ts.map

package/dist/vendor/tinbase/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../src/vendor/tinbase/jwt.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAiCH,gHAAgH;AAChH,MAAM,WAAW,SAAS;IACxB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;IACtB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,qFAAqF;IACrF,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,2FAA2F;IAC3F,GAAG,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CAC9C;AAED,mCAAmC;AACnC,wBAAsB,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAOhF;AAED,2EAA2E;AAC3E,wBAAsB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAuBxF;AAED,sEAAsE;AACtE,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAQzD;AAED,0GAA0G;AAC1G,wBAAgB,WAAW,CAAC,KAAK,SAAK,GAAG,MAAM,CAI9C"}

package/dist/vendor/tinbase/log-buffer.d.ts

@@ -0,0 +1,28 @@
+/**
+ * In-memory ring buffer of recent server log lines, surfaced in the Studio
+ * "Logs" pane (and available as backend.logs). Captures request lines and the
+ * internal log() output (migrations, mail, webhooks, cron). Dev convenience -
+ * bounded, never persisted.
+ */
+/** Severity derived from response status (or passed explicitly by internal log calls). */
+export type LogLevel = 'info' | 'warn' | 'error';
+/** One buffered log line. */
+export interface LogEntry {
+    /** ISO timestamp when pushed. */
+    ts: string;
+    level: LogLevel;
+    msg: string;
+}
+/** Bounded FIFO of the most recent {@link LogEntry} lines; oldest are dropped past `cap`. */
+export declare class LogBuffer {
+    private cap;
+    private entries;
+    constructor(cap?: number);
+    /** Append a line, evicting the oldest once over capacity. */
+    push(msg: string, level?: LogLevel): void;
+    /** Most recent first. */
+    list(limit?: number): LogEntry[];
+    /** Drop all buffered lines. */
+    clear(): void;
+}
+//# sourceMappingURL=log-buffer.d.ts.map

package/dist/vendor/tinbase/log-buffer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"log-buffer.d.ts","sourceRoot":"","sources":["../../../src/vendor/tinbase/log-buffer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,0FAA0F;AAC1F,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAA;AAEhD,6BAA6B;AAC7B,MAAM,WAAW,QAAQ;IACvB,iCAAiC;IACjC,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,QAAQ,CAAA;IACf,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,6FAA6F;AAC7F,qBAAa,SAAS;IAER,OAAO,CAAC,GAAG;IADvB,OAAO,CAAC,OAAO,CAAiB;gBACZ,GAAG,SAAM;IAE7B,6DAA6D;IAC7D,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,GAAE,QAAiB,GAAG,IAAI;IAKjD,yBAAyB;IACzB,IAAI,CAAC,KAAK,SAAM,GAAG,QAAQ,EAAE;IAI7B,+BAA+B;IAC/B,KAAK,IAAI,IAAI;CAGd"}

package/dist/vendor/tinbase/net/service.d.ts

@@ -0,0 +1,72 @@
+/**
+ * In-process HTTP sender for the pg_net emulation - the execution half of the
+ * net.* surface (the net.http_get/post/delete SQL functions live in
+ * db/emulated.ts). It drains net.http_request_queue, performs each request with
+ * fetch, and records the reply in net._http_response, mirroring pg_net's
+ * background worker. No C extension, works on the wasm and native engines.
+ */
+import type { Database } from '../db/database.js';
+/**
+ * Reject requests to non-public destinations. A synchronous literal-host guard
+ * (loopback / private / link-local / cloud-metadata) that also rejects
+ * alternate numeric IP encodings which would slip past the literal checks but
+ * still connect to a real address. No DNS lookup - a public hostname that
+ * *resolves* to private space (DNS rebinding) is a residual this doesn't cover;
+ * doing so would add a per-request lookup that can hang for 30s on an
+ * unresolvable host. Returns an error string, or null when the URL is allowed.
+ */
+export declare function blockedNetTarget(rawUrl: string): string | null;
+/**
+ * fetch with an SSRF guard that re-validates every redirect hop. Default fetch
+ * follows redirects without re-checking, so a public URL could 3xx into private
+ * space; this follows manually (capped at {@link MAX_REDIRECTS}) and runs
+ * {@link blockedNetTarget} on each target. Throws with the block reason on a
+ * rejected hop.
+ */
+export declare function guardedFetch(fetchImpl: typeof fetch, url: string, init?: RequestInit): Promise<Response>;
+/** Outcome of one drained request, passed to the optional `onDeliver` callback. */
+export interface NetDelivery {
+    /** net.http_request_queue row id */
+    id: number;
+    method: string;
+    url: string;
+    /** response status; undefined when the request failed before a reply */
+    status?: number;
+    /** true if the request aborted on its timeout */
+    timedOut: boolean;
+    /** failure reason (network error, blocked target, etc.); undefined on success */
+    error?: string;
+}
+/**
+ * Drains net.http_request_queue on an interval, performs each request, and
+ * records the reply in net._http_response - the pg_net background worker,
+ * in-process.
+ */
+export declare class NetService {
+    private db;
+    private fetchImpl;
+    /** how often to drain the queue (ms) */
+    private tickMs;
+    private onDeliver?;
+    private timer;
+    private draining;
+    /** The in-flight tick, tracked so stop() can drain it before db.close(). */
+    private inFlight;
+    constructor(db: Database, fetchImpl?: typeof fetch, 
+    /** how often to drain the queue (ms) */
+    tickMs?: number, onDeliver?: ((d: NetDelivery) => void) | undefined);
+    /** Begin draining the queue on the tick interval; no-op if already running. */
+    start(): void;
+    /**
+     * Stop the drain loop and wait for any in-flight tick to finish before the
+     * caller closes the database - the single connection busy-loops if closed
+     * while a query is still queued.
+     */
+    stop(): Promise<void>;
+    /** Drain any queued requests once (also callable directly in tests). */
+    tick(): Promise<void>;
+    private deliver;
+    /** Record the response and remove the request from the queue (best-effort). */
+    private record;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/vendor/tinbase/net/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/vendor/tinbase/net/service.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAQjD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAmB9D;AAqBD;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,SAAS,EAAE,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAWlH;AAWD,mFAAmF;AACnF,MAAM,WAAW,WAAW;IAC1B,oCAAoC;IACpC,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;IACX,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,iDAAiD;IACjD,QAAQ,EAAE,OAAO,CAAA;IACjB,iFAAiF;IACjF,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;;;GAIG;AACH,qBAAa,UAAU;IAOnB,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,SAAS;IACjB,wCAAwC;IACxC,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,SAAS,CAAC;IAVpB,OAAO,CAAC,KAAK,CAA8C;IAC3D,OAAO,CAAC,QAAQ,CAAQ;IACxB,4EAA4E;IAC5E,OAAO,CAAC,QAAQ,CAA6B;gBAGnC,EAAE,EAAE,QAAQ,EACZ,SAAS,GAAE,OAAO,KAAa;IACvC,wCAAwC;IAChC,MAAM,SAAM,EACZ,SAAS,CAAC,GAAE,CAAC,CAAC,EAAE,WAAW,KAAK,IAAI,aAAA;IAG9C,+EAA+E;IAC/E,KAAK,IAAI,IAAI;IAQb;;;;OAIG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAO3B,wEAAwE;IAClE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YA8Bb,OAAO;IA6CrB,+EAA+E;YACjE,MAAM;CAoBrB"}

package/dist/vendor/tinbase/node/bun-server.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Bun-native server: Bun.serve with first-class WebSockets. Used automatically
+ * when the CLI runs under Bun (including single-binary builds) - same backend,
+ * same RealtimeSocketLike contract as the node:http path.
+ */
+import type { SupaliteBackendShape } from './server-shared.js';
+export interface ServeOptions {
+    port?: number;
+    host?: string;
+}
+export interface ServerHandle {
+    readonly port?: number;
+    stop(closeActiveConnections?: boolean): void | Promise<void>;
+}
+export interface RunningServer {
+    server: ServerHandle;
+    port: number;
+    url: string;
+    close: () => Promise<void>;
+}
+/** Bun equivalent of {@link import('./server.js').serve}; same backend contract. */
+export declare function serveBun(backend: SupaliteBackendShape, opts?: ServeOptions): Promise<RunningServer>;
+//# sourceMappingURL=bun-server.d.ts.map

package/dist/vendor/tinbase/node/bun-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bun-server.d.ts","sourceRoot":"","sources":["../../../../src/vendor/tinbase/node/bun-server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAE9D,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,IAAI,CAAC,sBAAsB,CAAC,EAAE,OAAO,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC7D;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,YAAY,CAAA;IACpB,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3B;AASD,oFAAoF;AACpF,wBAAsB,QAAQ,CAAC,OAAO,EAAE,oBAAoB,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,CAmD7G"}

package/dist/vendor/tinbase/node/bundle-function.d.ts

@@ -0,0 +1,8 @@
+/** Map a Deno-style specifier to a fetchable URL. Pure - unit tested. */
+export declare function rewriteRemoteSpecifier(spec: string): string;
+/**
+ * Bundle `entryPath` to a single ESM file and return its path (written under
+ * the OS temp dir).
+ */
+export declare function bundleFunction(entryPath: string, name: string): Promise<string>;
+//# sourceMappingURL=bundle-function.d.ts.map

package/dist/vendor/tinbase/node/bundle-function.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-function.d.ts","sourceRoot":"","sources":["../../../../src/vendor/tinbase/node/bundle-function.ts"],"names":[],"mappings":"AAgBA,yEAAyE;AACzE,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI3D;AAsCD;;;GAGG;AACH,wBAAsB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAerF"}

package/dist/vendor/tinbase/node/config-toml.d.ts

@@ -0,0 +1,34 @@
+/** A parsed table: its scalar/array values plus nested child tables. */
+export interface ConfigTable {
+    /** scalar and single-line-array values declared directly under this table, by key */
+    values: Map<string, string | string[]>;
+    /** nested child tables, by their (single, undotted) segment name */
+    children: Map<string, ConfigTable>;
+}
+/** Environment values accepted by config.toml's env(VAR) substitution. */
+export type Environment = Record<string, string | undefined>;
+/** Parse config.toml at `projectDir/supabase/config.toml`; empty root if absent/unreadable. */
+export declare function loadConfigToml(projectDir: string, env?: Environment): ConfigTable;
+/** Parse TOML `text` into a table tree, resolving `env(VAR)` references. */
+export declare function parseConfigToml(text: string, env?: Environment): ConfigTable;
+/** Child table at a dotted path, or undefined if any segment is missing. */
+export declare function tableAt(root: ConfigTable, path: string): ConfigTable | undefined;
+/** String value at `key`, or undefined if absent, empty, or an array. */
+export declare function getString(table: ConfigTable | undefined, key: string): string | undefined;
+/** Boolean value at `key`, or undefined if absent or not exactly true/false. */
+export declare function getBool(table: ConfigTable | undefined, key: string): boolean | undefined;
+/** Integer value at `key` (base 10), or undefined if absent or unparseable. */
+export declare function getInt(table: ConfigTable | undefined, key: string): number | undefined;
+/** String-array value at `key`, or undefined if absent or a scalar. */
+export declare function getStringArray(table: ConfigTable | undefined, key: string): string[] | undefined;
+/**
+ * Parse a Supabase duration string ("1m", "24h", "10s", "50m") to seconds.
+ * Returns undefined if absent or malformed.
+ */
+export declare function getDurationSeconds(table: ConfigTable | undefined, key: string): number | undefined;
+/**
+ * Parse a Supabase byte-size string ("50MiB", "5MB", "500KB") to bytes.
+ * Returns undefined if absent or malformed.
+ */
+export declare function getByteSize(table: ConfigTable | undefined, key: string): number | undefined;
+//# sourceMappingURL=config-toml.d.ts.map

package/dist/vendor/tinbase/node/config-toml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-toml.d.ts","sourceRoot":"","sources":["../../../../src/vendor/tinbase/node/config-toml.ts"],"names":[],"mappings":"AAmBA,wEAAwE;AACxE,MAAM,WAAW,WAAW;IAC1B,qFAAqF;IACrF,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAA;IACtC,oEAAoE;IACpE,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;CACnC;AAED,0EAA0E;AAC1E,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;AAM5D,+FAA+F;AAC/F,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,GAAE,WAAyB,GAAG,WAAW,CAQ9F;AAED,4EAA4E;AAC5E,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,GAAE,WAAyB,GAAG,WAAW,CAiBzF;AAuDD,4EAA4E;AAC5E,wBAAgB,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAOhF;AAED,yEAAyE;AACzE,wBAAgB,SAAS,CAAC,KAAK,EAAE,WAAW,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGzF;AAED,gFAAgF;AAChF,wBAAgB,OAAO,CAAC,KAAK,EAAE,WAAW,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAKxF;AAED,+EAA+E;AAC/E,wBAAgB,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKtF;AAED,uEAAuE;AACvE,wBAAgB,cAAc,CAAC,KAAK,EAAE,WAAW,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAGhG;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,WAAW,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAWlG;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAiB3F"}

package/dist/vendor/tinbase/node/fs-driver.d.ts

@@ -0,0 +1,27 @@
+import type { StorageDriver } from '../types.js';
+/**
+ * Node-only {@link StorageDriver} that keeps object bytes as files under a
+ * single root directory. Keys map to relative paths beneath the root.
+ */
+export declare class FsStorageDriver implements StorageDriver {
+    private root;
+    constructor(root: string);
+    /**
+     * Resolve a storage key to an absolute path inside the root.
+     *
+     * SECURITY: rejects keys that escape the root (e.g. `../`); the normalized
+     * path must stay under `root` + separator or the key is refused.
+     *
+     * @throws if the key would resolve outside the root directory.
+     */
+    private resolve;
+    /** Write object bytes, creating parent directories as needed. */
+    put(key: string, data: Uint8Array): Promise<void>;
+    /** Read object bytes, or null if the key does not exist. */
+    get(key: string): Promise<Uint8Array | null>;
+    /** Delete an object; a missing key is not an error. */
+    delete(key: string): Promise<void>;
+    /** Delete several objects in sequence. */
+    deleteMany(keys: string[]): Promise<void>;
+}
+//# sourceMappingURL=fs-driver.d.ts.map

package/dist/vendor/tinbase/node/fs-driver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs-driver.d.ts","sourceRoot":"","sources":["../../../../src/vendor/tinbase/node/fs-driver.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAEhD;;;GAGG;AACH,qBAAa,eAAgB,YAAW,aAAa;IACvC,OAAO,CAAC,IAAI;gBAAJ,IAAI,EAAE,MAAM;IAEhC;;;;;;;OAOG;IACH,OAAO,CAAC,OAAO;IAQf,iEAAiE;IAC3D,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAavD,4DAA4D;IACtD,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IASlD,uDAAuD;IACjD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxC,0CAA0C;IACpC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAGhD"}

package/dist/vendor/tinbase/node/load-config.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Read everything tinbase can honor from an existing Supabase project's
+ * supabase/config.toml, so pointing tinbase at that project needs no new config.
+ *
+ * config.toml is one document, so this is one loader: parse once, then project
+ * the tree into a nested `ProjectConfig` that mirrors the file's sections. The
+ * CLI spreads those sections into createBackend. Sections for services tinbase
+ * doesn't run (SMS, analytics, pooler, studio/edge-runtime ports, experimental)
+ * are intentionally ignored.
+ */
+import type { AuthSettings } from '../auth/settings.js';
+import type { OAuthProviderConfig } from '../auth/oauth.js';
+import type { RateLimitRule } from '../auth/rate-limit.js';
+import type { BucketSeed } from '../types.js';
+import { type Environment } from './config-toml.js';
+/** The project's config.toml, projected into the shapes tinbase consumes. */
+export interface ProjectConfig {
+    /** the [auth] slice: settings, redirects, sessions, rate limits, OAuth */
+    auth: AuthConfig;
+    /** the [api] slice: exposed schemas and row cap */
+    api: ApiConfig;
+    /** the [storage] slice: default size limit and buckets to seed */
+    storage: StorageConfig;
+    /** the [db.seed] slice: whether/what to seed */
+    seed: SeedConfig;
+    /** per-function options keyed by function name ([functions.<name>]) */
+    functions: Record<string, FunctionOptions>;
+}
+/** The `[auth]` slice of config.toml, projected into the shapes the backend consumes. */
+export interface AuthConfig {
+    /** whether to run the auth service ([auth].enabled) */
+    enabled?: boolean;
+    /** runtime-toggleable settings, layered under the live auth.config table */
+    settings: Partial<AuthSettings>;
+    /** [auth].site_url */
+    siteUrl?: string;
+    /** [auth].jwt_expiry, seconds */
+    jwtExpiry?: number;
+    /** [auth].additional_redirect_urls */
+    uriAllowList?: string[];
+    /** [auth.rate_limit].* mapped to the auth limiter's rules */
+    rateLimits?: Record<string, RateLimitRule>;
+    /** [auth.sessions].timebox, seconds */
+    sessionTimeboxSeconds?: number;
+    /** [auth.sessions].inactivity_timeout, seconds */
+    sessionInactivitySeconds?: number;
+    /** OAuth providers from [auth.external.*] and env-var fallbacks */
+    oauthProviders: Record<string, OAuthProviderConfig>;
+}
+/** The `[api]` slice of config.toml. */
+export interface ApiConfig {
+    /** [api].schemas: schemas exposed through the Data API (db-schemas) */
+    schemas?: string[];
+    /** [api].max_rows: REST read row cap */
+    maxRows?: number;
+}
+/** The `[storage]` slice of config.toml. */
+export interface StorageConfig {
+    /** [storage].file_size_limit: default per-bucket byte limit */
+    fileSizeLimit?: number;
+    /** [storage.buckets.*]: buckets to create at boot */
+    buckets?: BucketSeed[];
+}
+/** The `[db.seed]` slice of config.toml. */
+export interface SeedConfig {
+    /** [db.seed].enabled */
+    enabled?: boolean;
+    /** [db.seed].sql_paths (files or globs, relative to supabase/) */
+    paths?: string[];
+}
+/** Per-function `[functions.<name>]` options. */
+export interface FunctionOptions {
+    /** [functions.<name>].enabled */
+    enabled?: boolean;
+    /** [functions.<name>].verify_jwt */
+    verifyJwt?: boolean;
+    /** [functions.<name>].entrypoint, relative to the project root */
+    entrypoint?: string;
+}
+/** Parse supabase/config.toml once and project it into a {@link ProjectConfig}. */
+export declare function loadProjectConfig(projectDir: string, env?: Environment): ProjectConfig;
+//# sourceMappingURL=load-config.d.ts.map

package/dist/vendor/tinbase/node/load-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-config.d.ts","sourceRoot":"","sources":["../../../../src/vendor/tinbase/node/load-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAC7C,OAAO,EAUL,KAAK,WAAW,EACjB,MAAM,kBAAkB,CAAA;AAEzB,6EAA6E;AAC7E,MAAM,WAAW,aAAa;IAC5B,0EAA0E;IAC1E,IAAI,EAAE,UAAU,CAAA;IAChB,mDAAmD;IACnD,GAAG,EAAE,SAAS,CAAA;IACd,kEAAkE;IAClE,OAAO,EAAE,aAAa,CAAA;IACtB,gDAAgD;IAChD,IAAI,EAAE,UAAU,CAAA;IAChB,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;CAC3C;AAED,yFAAyF;AACzF,MAAM,WAAW,UAAU;IACzB,uDAAuD;IACvD,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,4EAA4E;IAC5E,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;IAC/B,sBAAsB;IACtB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,iCAAiC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,sCAAsC;IACtC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;IAC1C,uCAAuC;IACvC,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,kDAAkD;IAClD,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,mEAAmE;IACnE,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;CACpD;AAED,wCAAwC;AACxC,MAAM,WAAW,SAAS;IACxB,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,wCAAwC;IACxC,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,4CAA4C;AAC5C,MAAM,WAAW,aAAa;IAC5B,+DAA+D;IAC/D,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,qDAAqD;IACrD,OAAO,CAAC,EAAE,UAAU,EAAE,CAAA;CACvB;AAED,4CAA4C;AAC5C,MAAM,WAAW,UAAU;IACzB,wBAAwB;IACxB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CACjB;AAED,iDAAiD;AACjD,MAAM,WAAW,eAAe;IAC9B,iCAAiC;IACjC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,oCAAoC;IACpC,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,mFAAmF;AACnF,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,GAAE,WAAyB,GAAG,aAAa,CASnG"}

package/dist/vendor/tinbase/node/load-functions.d.ts

@@ -0,0 +1,24 @@
+import type { EdgeFunction } from '../functions/handler.js';
+/**
+ * Load edge-function secrets from supabase/functions/.env (KEY=VALUE lines,
+ * `#` comments). These are exposed to functions via Deno.env and ctx.env -
+ * the local equivalent of `supabase functions serve --env-file`.
+ */
+export declare function loadFunctionEnv(projectDir: string): Promise<Record<string, string>>;
+/** Per-function options from config.toml [functions.<name>]. */
+export interface LoadFunctionOptions {
+    /** Skip loading when explicitly disabled. */
+    enabled?: boolean;
+    /** Custom entrypoint path, relative to the project root. */
+    entrypoint?: string;
+}
+/**
+ * Discover and load every edge function under supabase/functions/, keyed by
+ * directory name. Dirs starting with `_` or `.` are skipped (shared code), as
+ * are functions disabled in config.toml. Each function is bundled with esbuild
+ * when available (falling back to a plain import), then its handler is taken
+ * from a default export or a captured `Deno.serve()` call. Load failures warn
+ * and skip rather than throwing, so one broken function can't block startup.
+ */
+export declare function loadFunctions(projectDir: string, options?: Record<string, LoadFunctionOptions>): Promise<Map<string, EdgeFunction>>;
+//# sourceMappingURL=load-functions.d.ts.map

package/dist/vendor/tinbase/node/load-functions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-functions.d.ts","sourceRoot":"","sources":["../../../../src/vendor/tinbase/node/load-functions.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AAI3D;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAqBzF;AAED,gEAAgE;AAChE,MAAM,WAAW,mBAAmB;IAClC,6CAA6C;IAC7C,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAID;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAM,GAChD,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAYpC"}

package/dist/vendor/tinbase/node/project.d.ts

@@ -0,0 +1,21 @@
+import type { MigrationFile } from '../types.js';
+/** Migrations and optional seed SQL discovered under a project's supabase/ dir. */
+export interface SupabaseProject {
+    /** Migrations in filename order (timestamp-prefixed, so lexical == chronological). */
+    migrations: MigrationFile[];
+    /** Concatenated seed files, if any were found and seeding is enabled. */
+    seedSql?: string;
+}
+/** Seed config from config.toml [db.seed] (enabled + explicit file paths). */
+export interface SeedOptions {
+    /** whether seeding runs; only `false` disables it (undefined means enabled) */
+    enabled?: boolean;
+    /** Files or Bun glob patterns relative to supabase/, applied in order. Defaults to ['seed.sql']. */
+    paths?: string[];
+}
+/**
+ * Read supabase/migrations/*.sql (sorted) and, unless disabled, the configured
+ * seed files. A missing migrations dir or seed file is not an error.
+ */
+export declare function loadSupabaseProject(projectDir: string, seed?: SeedOptions): Promise<SupabaseProject>;
+//# sourceMappingURL=project.d.ts.map

package/dist/vendor/tinbase/node/project.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project.d.ts","sourceRoot":"","sources":["../../../../src/vendor/tinbase/node/project.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAEhD,mFAAmF;AACnF,MAAM,WAAW,eAAe;IAC9B,sFAAsF;IACtF,UAAU,EAAE,aAAa,EAAE,CAAA;IAC3B,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,8EAA8E;AAC9E,MAAM,WAAW,WAAW;IAC1B,+EAA+E;IAC/E,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,oGAAoG;IACpG,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CACjB;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAqC9G"}

package/dist/vendor/tinbase/node/server-shared.d.ts

@@ -0,0 +1,10 @@
+/** Backend shape shared by the node:http and Bun servers, keeping each decoupled from the full backend. */
+import type { RealtimeEngine } from '../realtime/engine.js';
+/** The slice of a backend that servers need - keeps bun/node servers decoupled. */
+export interface SupaliteBackendShape {
+    /** HTTP request handler; the server forwards every non-upgrade request here */
+    fetch: typeof fetch;
+    /** realtime engine the server hands accepted websocket connections to */
+    realtime: RealtimeEngine;
+}
+//# sourceMappingURL=server-shared.d.ts.map

package/dist/vendor/tinbase/node/server-shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-shared.d.ts","sourceRoot":"","sources":["../../../../src/vendor/tinbase/node/server-shared.ts"],"names":[],"mappings":"AAAA,2GAA2G;AAC3G,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAE3D,mFAAmF;AACnF,MAAM,WAAW,oBAAoB;IACnC,+EAA+E;IAC/E,KAAK,EAAE,OAAO,KAAK,CAAA;IACnB,yEAAyE;IACzE,QAAQ,EAAE,cAAc,CAAA;CACzB"}

package/dist/vendor/tinbase/realtime/engine.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Realtime engine speaking the Phoenix-channel protocol that
+ * @supabase/realtime-js uses (vsn=1.0.0 JSON serialization): channel
+ * join/leave, heartbeat, broadcast, presence, and postgres_changes fed by
+ * the trigger-based CDC pipeline in the database layer.
+ *
+ * Transport-agnostic: sockets are anything with send()/close(), so the same
+ * engine works over Node WebSockets today and an in-process pair in the
+ * browser.
+ */
+import type { Database } from '../db/database.js';
+/** The minimal socket surface the engine needs; any transport can supply it. */
+export interface RealtimeSocketLike {
+    /** send a text or binary frame to the client */
+    send(data: string | Uint8Array): void;
+    /** close the connection with an optional WebSocket close code/reason */
+    close(code?: number, reason?: string): void;
+}
+/** Holds all live connections and fans database changes and broadcasts out to them. */
+export declare class RealtimeEngine {
+    private db;
+    private jwtSecret?;
+    private connections;
+    private bindingCounter;
+    private phxRefCounter;
+    /** topic → key → metas */
+    private presence;
+    private stopCdc;
+    private stopDbBroadcast;
+    constructor(db: Database, jwtSecret?: string | undefined);
+    /** Resolve a subscriber's access token to a role/claims context. */
+    private contextFromToken;
+    /**
+     * Authorize a private channel against RLS on realtime.messages, as the
+     * subscriber. read = a SELECT policy lets them receive; write = an INSERT
+     * policy lets them broadcast. Runs in a transaction that always rolls back so
+     * the probe rows never persist.
+     */
+    private authorizePrivate;
+    /** Fan a realtime.send() database broadcast out to a topic's subscribers. */
+    private dispatchDbBroadcast;
+    /** Wire up the CDC and database-broadcast listeners; idempotent once started. */
+    start(): Promise<void>;
+    /** Detach listeners and close every open socket (server shutdown). */
+    stop(): void;
+    /** Attach a socket. Returns callbacks the transport must wire up. */
+    connect(socket: RealtimeSocketLike, opts?: {
+        vsn?: string;
+    }): {
+        onMessage: (data: string | Uint8Array) => void;
+        onClose: () => void;
+    };
+    private send;
+    private reply;
+    private handleMessage;
+    private handleJoin;
+    private leaveChannel;
+    /**
+     * Phoenix binary serializer, kind 3 (userBroadcastPush):
+     * [3, joinRefLen, refLen, topicLen, eventLen, metaLen, encoding,
+     *  joinRef, ref, topic, event, meta, payloadBytes]
+     * encoding: 0 = raw binary payload, 1 = JSON payload
+     */
+    private handleBinary;
+    private handleBroadcast;
+    private handlePresence;
+    private broadcastToTopic;
+    private dispatchCdc;
+    /**
+     * Whether a subscriber may receive a given change event under RLS.
+     * - service_role (bypassrls) and non-RLS tables: always.
+     * - INSERT/UPDATE on an RLS table: re-query the row by PK as the subscriber;
+     *   deliver only if the currently visible row still matches the event snapshot.
+     * - DELETE on an RLS table: only service_role receives it because the deleted
+     *   row can no longer be re-queried safely as an ordinary subscriber.
+     */
+    private canSee;
+    private bindingMatches;
+}
+/** Evaluate a realtime filter string ("col=eq.value") against a row. */
+export declare function matchFilter(filter: string, row: Record<string, unknown>): boolean;
+//# sourceMappingURL=engine.d.ts.map

package/dist/vendor/tinbase/realtime/engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../../../src/vendor/tinbase/realtime/engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAY,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAK3D,gFAAgF;AAChF,MAAM,WAAW,kBAAkB;IACjC,gDAAgD;IAChD,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAAA;IACrC,wEAAwE;IACxE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC5C;AA+DD,uFAAuF;AACvF,qBAAa,cAAc;IAUvB,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,SAAS,CAAC;IAVpB,OAAO,CAAC,WAAW,CAAwB;IAC3C,OAAO,CAAC,cAAc,CAAI;IAC1B,OAAO,CAAC,aAAa,CAAI;IACzB,0BAA0B;IAC1B,OAAO,CAAC,QAAQ,CAAgD;IAChE,OAAO,CAAC,OAAO,CAA4B;IAC3C,OAAO,CAAC,eAAe,CAA4B;gBAGzC,EAAE,EAAE,QAAQ,EACZ,SAAS,CAAC,EAAE,MAAM,YAAA;IAG5B,oEAAoE;YACtD,gBAAgB;IAQ9B;;;;;OAKG;YACW,gBAAgB;IA0C9B,6EAA6E;IAC7E,OAAO,CAAC,mBAAmB;IAc3B,iFAAiF;IAC3E,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAa5B,sEAAsE;IACtE,IAAI,IAAI,IAAI;IASZ,qEAAqE;IACrE,OAAO,CAAC,MAAM,EAAE,kBAAkB,EAAE,IAAI,GAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG;QAChE,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,KAAK,IAAI,CAAA;QAC9C,OAAO,EAAE,MAAM,IAAI,CAAA;KACpB;IAcD,OAAO,CAAC,IAAI;IAYZ,OAAO,CAAC,KAAK;YAUC,aAAa;YAgEb,UAAU;IAsGxB,OAAO,CAAC,YAAY;IAmBpB;;;;;OAKG;IACH,OAAO,CAAC,YAAY;IA+BpB,OAAO,CAAC,eAAe;IA8BvB,OAAO,CAAC,cAAc;IA+CtB,OAAO,CAAC,gBAAgB;YAQV,WAAW;IAoDzB;;;;;;;OAOG;YACW,MAAM;IA6BpB,OAAO,CAAC,cAAc;CAUvB;AAkBD,wEAAwE;AACxE,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CA2BjF"}