@supacloud/lite 0.2.0

package/dist/vendor/tinbase/rest/build.d.ts

@@ -0,0 +1,101 @@
+/**
+ * Builds SQL from a ParsedQuery + schema introspection. All row data is
+ * serialized to JSON inside Postgres (row_to_json/json_agg), so results come
+ * back with correct JSON types and zero client-side type mapping.
+ */
+import { type SchemaInfo } from '../db/database.js';
+import { type Cond, type ParsedQuery } from './parse.js';
+/** A built SQL statement plus its bind params and an optional separate count query. */
+export interface BuiltQuery {
+    /** SQL text with `$n` placeholders */
+    sql: string;
+    /** positional bind values for the placeholders */
+    params: unknown[];
+    /** separate exact-count query, emitted only when the client asked for a count */
+    countSql?: string;
+}
+/** Builds SQL for one PostgREST request against a single schema's introspection. */
+export declare class QueryBuilder {
+    private schema;
+    private info;
+    private q;
+    private aliasCounter;
+    private consumedPaths;
+    /** pg-mem can't bind a table alias in UPDATE/DELETE; omit it for subset engines. */
+    private aliasMutations;
+    constructor(schema: string, info: SchemaInfo, q: ParsedQuery, opts?: {
+        aliasMutations?: boolean;
+    });
+    private nextAlias;
+    private qualify;
+    private table;
+    /** Build the SELECT (with embeds/filters/order/pagination), plus an optional count query. */
+    buildSelect(table: string, opts?: {
+        count?: boolean;
+    }): BuiltQuery;
+    /**
+     * Aggregate select: `count()`, `col.sum()`, `col.avg()`, `col.max()`,
+     * `col.min()`. Any non-aggregate column becomes an implicit GROUP BY key, so
+     * `select=author_id,views.sum()` yields one row per author. Output keys are
+     * the aggregate name (or the column's alias) and the grouping column names.
+     */
+    private buildAggregateSelect;
+    /**
+     * Build a multi-row INSERT, optionally with ON CONFLICT upsert semantics.
+     * @param opts.upsert merge-duplicates (do update) or ignore-duplicates (do nothing)
+     * @param opts.missingDefault emit `default` for absent columns instead of `null`
+     * @param opts.returning wrap in a CTE so select= can shape the returned rows
+     */
+    buildInsert(table: string, rows: Record<string, unknown>[], opts: {
+        upsert?: 'merge-duplicates' | 'ignore-duplicates';
+        missingDefault?: boolean;
+        returning: boolean;
+    }): BuiltQuery;
+    /** Build an UPDATE scoped by the base filters; SET comes from the JSON body. */
+    buildUpdate(table: string, body: Record<string, unknown>, opts: {
+        returning: boolean;
+    }): BuiltQuery;
+    /** Build a DELETE scoped by the base filters. */
+    buildDelete(table: string, opts: {
+        returning: boolean;
+    }): BuiltQuery;
+    /** Wrap a mutation in a CTE so the response can apply select= (incl. embeds). */
+    private wrapMutation;
+    private buildSelectList;
+    private buildEmbed;
+    /** Whether `columns` (order-independent) form a PK/UNIQUE key on `table`. */
+    private isUniqueKey;
+    private findRelationship;
+    private baseWhere;
+    /** Render one condition (leaf filter or and/or subtree) as a SQL boolean expression. */
+    renderCond(cond: Cond, alias: string): string;
+    private renderLogic;
+    /** Render the `order by` clause for the terms scoped to the given embed path (`[]` = base). */
+    renderOrder(path: string[], alias: string): string;
+    /** Render `limit`/`offset` for the given path key (`''` = base); empty when neither is set. */
+    renderLimitOffset(pathKey: string): string;
+    private assertAllPathsConsumed;
+    private requireColumn;
+    private pushParam;
+}
+/**
+ * Render a (possibly JSON-arrowed) column reference: `data->a->>b` becomes
+ * `"data"->'a'->>'b'`; numeric keys become array indexes.
+ * SECURITY: the base column is quoted as an identifier and text keys are quoted
+ * as literals, so a hostile column/key name can't break out of the expression.
+ */
+export declare function renderColumnExpr(alias: string, raw: string): string;
+/**
+ * Validate a `::type` cast against an identifier-plus-`[]` allowlist and return it.
+ * SECURITY: casts are interpolated raw into SQL, so this reject is the only guard
+ * against injection through the cast token.
+ * @throws ParseError when the cast is not a bare type name (optionally array).
+ */
+export declare function sanitizeCast(cast: string): string;
+/**
+ * Serialize a JS array into a Postgres array literal (`{a,b,...}`), recursing
+ * for nested arrays. Elements are double-quoted with backslash/quote escaping so
+ * the literal survives being bound as a parameter and cast to the target type.
+ */
+export declare function pgArrayLiteral(arr: unknown[]): string;
+//# sourceMappingURL=build.d.ts.map

package/dist/vendor/tinbase/rest/build.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../../src/vendor/tinbase/rest/build.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAA8D,KAAK,UAAU,EAAkB,MAAM,mBAAmB,CAAA;AAE/H,OAAO,EAKL,KAAK,IAAI,EAGT,KAAK,WAAW,EAGjB,MAAM,YAAY,CAAA;AAoBnB,uFAAuF;AACvF,MAAM,WAAW,UAAU;IACzB,sCAAsC;IACtC,GAAG,EAAE,MAAM,CAAA;IACX,kDAAkD;IAClD,MAAM,EAAE,OAAO,EAAE,CAAA;IACjB,iFAAiF;IACjF,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAKD,oFAAoF;AACpF,qBAAa,YAAY;IAQrB,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,IAAI;IACZ,OAAO,CAAC,CAAC;IATX,OAAO,CAAC,YAAY,CAAI;IACxB,OAAO,CAAC,aAAa,CAAwB;IAE7C,oFAAoF;IACpF,OAAO,CAAC,cAAc,CAAS;gBAGrB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,UAAU,EAChB,CAAC,EAAE,WAAW,EACtB,IAAI,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,OAAO,CAAA;KAAE;IAKrC,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,OAAO;IAIf,OAAO,CAAC,KAAK;IAeb,6FAA6F;IAC7F,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,UAAU;IAsBtE;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB;IAqC5B;;;;;OAKG;IACH,WAAW,CACT,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAC/B,IAAI,EAAE;QACJ,MAAM,CAAC,EAAE,kBAAkB,GAAG,mBAAmB,CAAA;QACjD,cAAc,CAAC,EAAE,OAAO,CAAA;QACxB,SAAS,EAAE,OAAO,CAAA;KACnB,GACA,UAAU;IAqDb,gFAAgF;IAChF,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE;QAAE,SAAS,EAAE,OAAO,CAAA;KAAE,GAAG,UAAU;IAkBnG,iDAAiD;IACjD,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE;QAAE,SAAS,EAAE,OAAO,CAAA;KAAE,GAAG,UAAU;IAWpE,iFAAiF;IACjF,OAAO,CAAC,YAAY;IAgBpB,OAAO,CAAC,eAAe;IA4BvB,OAAO,CAAC,UAAU;IA4FlB,6EAA6E;IAC7E,OAAO,CAAC,WAAW;IAOnB,OAAO,CAAC,gBAAgB;IAoExB,OAAO,CAAC,SAAS;IAQjB,wFAAwF;IACxF,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM;IAK7C,OAAO,CAAC,WAAW;IASnB,+FAA+F;IAC/F,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM;IAalD,+FAA+F;IAC/F,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;IAS1C,OAAO,CAAC,sBAAsB;IA0B9B,OAAO,CAAC,aAAa;IAarB,OAAO,CAAC,SAAS;CA0BlB;AAID;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAWnE;AAOD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGjD;AASD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,MAAM,CASrD"}

package/dist/vendor/tinbase/rest/errors.d.ts

@@ -0,0 +1,11 @@
+/** HTTP status for a Postgres SQLSTATE, following PostgREST's mapping. */
+export declare function statusForSqlState(code: string): number;
+/**
+ * Normalize any thrown value into a JSON Response: ApiError/ParseError keep
+ * their status; anything with a 5-char SQLSTATE is mapped via
+ * {@link statusForSqlState}; everything else becomes a 500.
+ */
+export declare function errorToResponse(e: unknown): Response;
+/** JSON Response helper; status 204 sends no body. */
+export declare function jsonResponse(status: number, body: unknown, headers?: Record<string, string>): Response;
+//# sourceMappingURL=errors.d.ts.map

package/dist/vendor/tinbase/rest/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../../src/vendor/tinbase/rest/errors.ts"],"names":[],"mappings":"AAQA,0EAA0E;AAC1E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAkBtD;AAUD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,GAAG,QAAQ,CAkBpD;AAED,sDAAsD;AACtD,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,EACb,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GACnC,QAAQ,CAKV"}

package/dist/vendor/tinbase/rest/handler.d.ts

@@ -0,0 +1,28 @@
+/**
+ * The Data API: a PostgREST-compatible REST layer over /rest/v1/*. Routes
+ * table CRUD and RPC calls, parses the query string, delegates SQL generation
+ * to {@link QueryBuilder}, and renders PostgREST-shaped responses (Content-Range
+ * counts, singular-object media type, Prefer handling).
+ */
+import { type Database } from '../db/database.js';
+import { type RequestContext } from '../types.js';
+/** Dispatches /rest/v1/* requests to table or RPC handling and builds responses. */
+export declare class RestHandler {
+    private db;
+    /** Schemas reachable through the Data API for non-privileged roles (PostgREST db-schemas). */
+    private exposedSchemas;
+    /** Max rows a read returns (PostgREST db-max-rows). Undefined = unlimited. */
+    private maxRows?;
+    constructor(db: Database, opts?: {
+        exposedSchemas?: string[];
+        maxRows?: number;
+    });
+    /** Entry point: resolve the profile schema, enforce schema exposure, route to table/rpc. */
+    handle(req: Request, ctx: RequestContext, url: URL): Promise<Response>;
+    private handleTable;
+    private runMutation;
+    private dataResponse;
+    private handleRpc;
+    private runRpc;
+}
+//# sourceMappingURL=handler.d.ts.map

package/dist/vendor/tinbase/rest/handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../../src/vendor/tinbase/rest/handler.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAA4B,KAAK,QAAQ,EAAqB,MAAM,mBAAmB,CAAA;AAC9F,OAAO,EAAY,KAAK,cAAc,EAAE,MAAM,aAAa,CAAA;AAyE3D,oFAAoF;AACpF,qBAAa,WAAW;IAOpB,OAAO,CAAC,EAAE;IANZ,8FAA8F;IAC9F,OAAO,CAAC,cAAc,CAAU;IAChC,8EAA8E;IAC9E,OAAO,CAAC,OAAO,CAAC,CAAQ;gBAGd,EAAE,EAAE,QAAQ,EACpB,IAAI,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE;IAMxD,4FAA4F;IACtF,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;YAmC9D,WAAW;YAoHX,WAAW;IA4CzB,OAAO,CAAC,YAAY;YA4CN,SAAS;YAqET,MAAM;CAmFrB"}

package/dist/vendor/tinbase/rest/parse.d.ts

@@ -0,0 +1,95 @@
+/**
+ * Parser for the PostgREST query grammar as emitted by supabase-js
+ * (postgrest-js): select trees with embedded resources, filter operators,
+ * and/or logic trees, ordering, and pagination.
+ */
+/** A selected column, optionally aliased and/or cast. */
+export interface SelectColumn {
+    kind: 'column';
+    /** raw column expression, may contain json arrows: data->>key */
+    name: string;
+    alias?: string;
+    cast?: string;
+    /** aggregate function applied to the column (col.sum(), count(), ...) */
+    aggregate?: 'avg' | 'count' | 'max' | 'min' | 'sum';
+}
+/** An embedded related resource, e.g. `author(name)` or `...profile(bio)`. */
+export interface SelectEmbed {
+    kind: 'embed';
+    /** relation (table) name or fk hint target */
+    name: string;
+    alias?: string;
+    /** disambiguation hint: fk constraint name, column name, or junction table */
+    hint?: string;
+    /** `!inner` - turn the embed into an inner join (filters out unmatched base rows) */
+    inner: boolean;
+    children: SelectItem[];
+    /** `...rel` spread - merge the related row's columns into the parent instead of nesting */
+    spread: boolean;
+}
+/** One entry in a `select=` list: a plain column or an embedded resource. */
+export type SelectItem = SelectColumn | SelectEmbed;
+/** A single `column=op.value` filter, possibly scoped to an embed path. */
+export interface FilterCond {
+    kind: 'filter';
+    /** embed path, [] = base table */
+    path: string[];
+    column: string;
+    negated: boolean;
+    op: string;
+    value: string;
+    /** text-search config, e.g. fts(english).query */
+    ftsConfig?: string;
+}
+/** An `and(...)`/`or(...)` group of conditions, optionally negated with `not`. */
+export interface LogicCond {
+    kind: 'logic';
+    path: string[];
+    op: 'and' | 'or';
+    negated: boolean;
+    conditions: Cond[];
+}
+/** A leaf filter or an and/or subtree. */
+export type Cond = FilterCond | LogicCond;
+/** One `order=` term. `nullsFirst` undefined = let Postgres pick the default. */
+export interface OrderTerm {
+    path: string[];
+    column: string;
+    asc: boolean;
+    nullsFirst?: boolean;
+}
+/** The fully parsed query string, consumed by the QueryBuilder. */
+export interface ParsedQuery {
+    /** select tree; defaults to a single `*` column when no `select=` was given */
+    select: SelectItem[];
+    /** base and embed-scoped filters, plus and/or logic trees */
+    conditions: Cond[];
+    /** ordering terms, each tagged with the embed path it applies to */
+    order: OrderTerm[];
+    /** per-path row limit; key = path joined with '.', '' = base */
+    limits: Map<string, number>;
+    /** per-path row offset; same keying as `limits` */
+    offsets: Map<string, number>;
+    /** `on_conflict=` target columns for upsert */
+    onConflict?: string[];
+    /** explicit insert column set from `columns=`; absent = infer from the body rows */
+    columns?: string[];
+}
+/** Thrown on malformed query syntax; mapped to a 400 PGRST100 by the handler. */
+export declare class ParseError extends Error {
+}
+/** PostgREST filter operator → SQL operator/keyword. */
+export declare const FILTER_OPS: Record<string, string>;
+/** Parse a full URLSearchParams into a {@link ParsedQuery}. Unknown reserved keys and `apikey` are skipped. */
+export declare function parseQuery(searchParams: URLSearchParams): ParsedQuery;
+/** Split on a delimiter, ignoring delimiters inside parens and double quotes. */
+export declare function splitTopLevel(str: string, delim: string): string[];
+/** Strip surrounding double quotes and unescape `\"`; passthrough when unquoted. */
+export declare function unquote(s: string): string;
+/**
+ * Parse a `select=` list into select items (columns and embeds), splitting at
+ * top level so nested embeds and quoted names stay intact.
+ * Grammar example: `select=a,b:c,d::text,rel!hint!inner(x,nested(y)),...spread(a)`
+ */
+export declare function parseSelect(value: string): SelectItem[];
+//# sourceMappingURL=parse.d.ts.map

package/dist/vendor/tinbase/rest/parse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../../../src/vendor/tinbase/rest/parse.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,yDAAyD;AACzD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,QAAQ,CAAA;IACd,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,yEAAyE;IACzE,SAAS,CAAC,EAAE,KAAK,GAAG,OAAO,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAA;CACpD;AAED,8EAA8E;AAC9E,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,OAAO,CAAA;IACb,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,8EAA8E;IAC9E,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,qFAAqF;IACrF,KAAK,EAAE,OAAO,CAAA;IACd,QAAQ,EAAE,UAAU,EAAE,CAAA;IACtB,2FAA2F;IAC3F,MAAM,EAAE,OAAO,CAAA;CAChB;AAED,6EAA6E;AAC7E,MAAM,MAAM,UAAU,GAAG,YAAY,GAAG,WAAW,CAAA;AAEnD,2EAA2E;AAC3E,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,QAAQ,CAAA;IACd,kCAAkC;IAClC,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,OAAO,CAAA;IAChB,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,kFAAkF;AAClF,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,OAAO,CAAA;IACb,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,EAAE,EAAE,KAAK,GAAG,IAAI,CAAA;IAChB,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,IAAI,EAAE,CAAA;CACnB;AAED,0CAA0C;AAC1C,MAAM,MAAM,IAAI,GAAG,UAAU,GAAG,SAAS,CAAA;AAEzC,iFAAiF;AACjF,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,OAAO,CAAA;IACZ,UAAU,CAAC,EAAE,OAAO,CAAA;CACrB;AAED,mEAAmE;AACnE,MAAM,WAAW,WAAW;IAC1B,+EAA+E;IAC/E,MAAM,EAAE,UAAU,EAAE,CAAA;IACpB,6DAA6D;IAC7D,UAAU,EAAE,IAAI,EAAE,CAAA;IAClB,oEAAoE;IACpE,KAAK,EAAE,SAAS,EAAE,CAAA;IAClB,gEAAgE;IAChE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC3B,mDAAmD;IACnD,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,+CAA+C;IAC/C,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB,oFAAoF;IACpF,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB;AAED,iFAAiF;AACjF,qBAAa,UAAW,SAAQ,KAAK;CAAG;AAIxC,wDAAwD;AACxD,eAAO,MAAM,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAQ7C,CAAA;AAED,+GAA+G;AAC/G,wBAAgB,UAAU,CAAC,YAAY,EAAE,eAAe,GAAG,WAAW,CAuDrE;AAkED,iFAAiF;AACjF,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CA8BlE;AAED,oFAAoF;AACpF,wBAAgB,OAAO,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAKzC;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,EAAE,CAEvD"}

package/dist/vendor/tinbase/retention/service.d.ts

@@ -0,0 +1,41 @@
+/**
+ * In-process data-retention sweeper. Periodically purges expired or stale rows
+ * that would otherwise accumulate forever: consumed/expired one-time tokens,
+ * revoked and aged-out refresh tokens, expired MFA challenges and OAuth flow
+ * state, and audit-log entries past the retention window.
+ *
+ * Supports GDPR data-minimization and keeps the auth tables from growing
+ * unbounded. All windows are configurable; a window of 0 disables that sweep.
+ */
+import type { Database } from '../db/database.js';
+/** Retention windows for the background sweep; a window of 0 disables that sweep. */
+export interface RetentionConfig {
+    /** How often to run a sweep (ms). Default 1 hour. */
+    intervalMs?: number;
+    /** Delete audit_log_entries older than this many days (0 = keep forever). Default 90. */
+    auditLogDays?: number;
+    /** Delete revoked/expired refresh tokens older than this many days (0 = keep). Default 30. */
+    refreshTokenDays?: number;
+}
+/** Periodically purges expired/stale auth rows so those tables can't grow unbounded. */
+export declare class RetentionService {
+    private db;
+    private now;
+    private timer;
+    private inFlight;
+    private readonly intervalMs;
+    private readonly auditLogDays;
+    private readonly refreshTokenDays;
+    constructor(db: Database, config?: RetentionConfig, now?: () => Date);
+    /** Sweep once at boot, then on the configured interval; no-op if already running. */
+    start(): void;
+    /**
+     * Stop future sweeps and wait for any in-flight one to settle, so the caller
+     * can safely close the database without racing a queued sweep query.
+     */
+    stop(): Promise<void>;
+    /** Run a single retention pass (also callable directly in tests). */
+    sweep(): Promise<void>;
+    private run;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/vendor/tinbase/retention/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/vendor/tinbase/retention/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAEjD,qFAAqF;AACrF,MAAM,WAAW,eAAe;IAC9B,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,yFAAyF;IACzF,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,8FAA8F;IAC9F,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAID,wFAAwF;AACxF,qBAAa,gBAAgB;IAYzB,OAAO,CAAC,EAAE;IAEV,OAAO,CAAC,GAAG;IAbb,OAAO,CAAC,KAAK,CAA8C;IAK3D,OAAO,CAAC,QAAQ,CAAmC;IACnD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAQ;IACnC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAQ;IACrC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAQ;gBAG/B,EAAE,EAAE,QAAQ,EACpB,MAAM,GAAE,eAAoB,EACpB,GAAG,GAAE,MAAM,IAAuB;IAO5C,qFAAqF;IACrF,KAAK,IAAI,IAAI;IAUb;;;OAGG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAM3B,qEAAqE;IAC/D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;YAed,GAAG;CAOlB"}

package/dist/vendor/tinbase/security.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Whether `host` exposes the server beyond loopback. Wildcard binds
+ * (`0.0.0.0`, `::`) and any concrete non-loopback address count as exposed.
+ */
+export declare function isNetworkExposed(host: string | undefined): boolean;
+/** Inputs to {@link assertSecretsSafe}: the bind host, the secrets in use, and a warning sink. */
+export interface SecretGuardInput {
+    /** host the server is bound to; drives the loopback-vs-exposed decision */
+    host?: string;
+    /** the JWT secret in use; a weak/default value is only allowed on loopback */
+    jwtSecret: string;
+    /** whether the vault key was derived from the JWT secret rather than set explicitly */
+    vaultKeyDerived: boolean;
+    /** sink for non-fatal warnings (loopback-only weak-secret notices) */
+    warn: (msg: string) => void;
+}
+/**
+ * Enforce secret hygiene at boot. On a loopback bind, weak defaults only warn;
+ * on a network-exposed bind they throw, refusing to start with forgeable
+ * credentials. Returns nothing; throws {@link Error} to abort startup.
+ */
+export declare function assertSecretsSafe(input: SecretGuardInput): void;
+//# sourceMappingURL=security.d.ts.map

package/dist/vendor/tinbase/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/vendor/tinbase/security.ts"],"names":[],"mappings":"AAYA;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAElE;AAED,kGAAkG;AAClG,MAAM,WAAW,gBAAgB;IAC/B,2EAA2E;IAC3E,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,8EAA8E;IAC9E,SAAS,EAAE,MAAM,CAAA;IACjB,uFAAuF;IACvF,eAAe,EAAE,OAAO,CAAA;IACxB,sEAAsE;IACtE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAC5B;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,gBAAgB,GAAG,IAAI,CA6B/D"}

package/dist/vendor/tinbase/storage/driver.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Storage backends for object bytes. The default is in-memory; persistent
+ * drivers (disk, S3) implement the same StorageDriver interface.
+ */
+import type { StorageDriver } from '../types.js';
+/**
+ * Default driver - keeps object bytes in memory, keyed by "bucket/key".
+ * Browser-safe (no fs); bytes are lost on restart.
+ */
+export declare class MemoryStorageDriver implements StorageDriver {
+    private files;
+    put(key: string, data: Uint8Array): Promise<void>;
+    get(key: string): Promise<Uint8Array | null>;
+    delete(key: string): Promise<void>;
+    deleteMany(keys: string[]): Promise<void>;
+}
+//# sourceMappingURL=driver.d.ts.map

package/dist/vendor/tinbase/storage/driver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"driver.d.ts","sourceRoot":"","sources":["../../../../src/vendor/tinbase/storage/driver.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAEhD;;;GAGG;AACH,qBAAa,mBAAoB,YAAW,aAAa;IACvD,OAAO,CAAC,KAAK,CAAgC;IAEvC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjD,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAI5C,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAGhD"}

package/dist/vendor/tinbase/storage/handler.d.ts

@@ -0,0 +1,76 @@
+/**
+ * storage-api-compatible endpoints (/storage/v1/*) for supabase-js's
+ * StorageClient. Object metadata lives in storage.objects (RLS enforced
+ * through the request role); bytes live behind a StorageDriver.
+ */
+import type { Database } from '../db/database.js';
+import type { BucketSeed, RequestContext, StorageDriver } from '../types.js';
+/** Construction options for {@link StorageHandler}. */
+export interface StorageConfig {
+    /** secret used to sign and verify signed download/upload URL tokens */
+    jwtSecret: string;
+    /** default per-bucket byte limit applied when a bucket sets none (config.toml storage.file_size_limit) */
+    defaultFileSizeLimit?: number;
+    /** sink for progress/warning lines (e.g. image-transform no-op); no-op when omitted */
+    log?: (message: string) => void;
+}
+/** Routes /storage/v1/* requests to bucket and object operations. */
+export declare class StorageHandler {
+    private db;
+    private driver;
+    private config;
+    private tusUploads;
+    private mutationTail;
+    constructor(db: Database, driver: StorageDriver, config: StorageConfig);
+    /** Create the given buckets if they don't already exist (config.toml storage.buckets.*). */
+    ensureBuckets(buckets: BucketSeed[]): Promise<void>;
+    /** Entry point: match the path to a bucket/object endpoint and map thrown errors to storage-api responses. */
+    handle(req: Request, ctx: RequestContext, url: URL): Promise<Response>;
+    private withMutation;
+    private requireService;
+    private createBucket;
+    private listBuckets;
+    private getBucket;
+    private updateBucket;
+    private deleteBucket;
+    private emptyBucket;
+    private loadBucket;
+    private upload;
+    private transformImageResponse;
+    /** Write immutable bytes first, then atomically switch the metadata pointer. */
+    private persistObject;
+    private handleTus;
+    /** Append a chunk at `offset`; finalize the object once fully received. */
+    private appendTus;
+    private pruneTusUploads;
+    private effectiveFileSizeLimit;
+    private preflightObjectWrite;
+    private download;
+    private downloadPublic;
+    private serveObject;
+    private removeObjects;
+    private removeOne;
+    private moveOrCopy;
+    private stageObjectBytes;
+    private discardStagedBytes;
+    private readObjectBytes;
+    private cleanupObjectRows;
+    private listObjects;
+    private objectInfo;
+    private signUrl;
+    private signUrls;
+    private redeemSignedUrl;
+    private signUploadUrl;
+    private redeemSignedUpload;
+    private makeSignToken;
+}
+interface MultipartPart {
+    name: string;
+    filename?: string;
+    contentType?: string;
+    data: Uint8Array;
+}
+/** Minimal byte-safe multipart/form-data parser (works identically on Node, Bun, browsers). */
+export declare function parseMultipart(bytes: Uint8Array, boundary: string): MultipartPart[];
+export {};
+//# sourceMappingURL=handler.d.ts.map

package/dist/vendor/tinbase/storage/handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../../src/vendor/tinbase/storage/handler.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAQjD,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE5E,uDAAuD;AACvD,MAAM,WAAW,aAAa;IAC5B,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAA;IACjB,0GAA0G;IAC1G,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,uFAAuF;IACvF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAChC;AAqGD,qEAAqE;AACrE,qBAAa,cAAc;IAKvB,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,MAAM;IANhB,OAAO,CAAC,UAAU,CAA+B;IACjD,OAAO,CAAC,YAAY,CAAoB;gBAG9B,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,aAAa;IAG/B,4FAA4F;IACtF,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAazD,8GAA8G;IACxG,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;YA6G9D,YAAY;IAgB1B,OAAO,CAAC,cAAc;YAOR,YAAY;YA2BZ,WAAW;YAKX,SAAS;YAMT,YAAY;YAqBZ,YAAY;YAYZ,WAAW;YAUX,UAAU;YAKV,MAAM;YAyDN,sBAAsB;IAgBpC,gFAAgF;YAClE,aAAa;YA2Cb,SAAS;IA6KvB,2EAA2E;YAC7D,SAAS;IA0CvB,OAAO,CAAC,eAAe;IAWvB,OAAO,CAAC,sBAAsB;YAMhB,oBAAoB;YA2CpB,QAAQ;YASR,cAAc;YAYd,WAAW;YAoBX,aAAa;YAeb,SAAS;YAUT,UAAU;YAuEV,gBAAgB;YAUhB,kBAAkB;YASlB,eAAe;YAKf,iBAAiB;YAcjB,WAAW;YAsDX,UAAU;YAyBV,OAAO;YAmBP,QAAQ;YAiBR,eAAe;YAef,aAAa;YAab,kBAAkB;IAehC,OAAO,CAAC,aAAa;CAUtB;AAsHD,UAAU,aAAa;IACrB,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,EAAE,UAAU,CAAA;CACjB;AAED,+FAA+F;AAC/F,wBAAgB,cAAc,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG,aAAa,EAAE,CAqCnF"}

package/dist/vendor/tinbase/storage/image-transform.d.ts

@@ -0,0 +1,38 @@
+export type ImageTransformResize = 'contain' | 'fill';
+export type ImageTransformFormat = 'origin' | 'jpeg' | 'png' | 'webp';
+export interface ImageTransformOptions {
+    width?: number;
+    height?: number;
+    resize: ImageTransformResize;
+    quality?: number;
+    format: ImageTransformFormat;
+}
+export interface ImageTransformRequestOptions {
+    width?: number;
+    height?: number;
+    resize?: ImageTransformResize | 'cover';
+    quality?: number;
+    format?: ImageTransformFormat;
+}
+export interface ImageTransformError {
+    ok: false;
+    status: 400 | 413 | 415 | 422;
+    error: string;
+    message: string;
+}
+export type ImageTransformParseResult = {
+    ok: true;
+    value: ImageTransformOptions;
+} | ImageTransformError;
+export type ImageTransformResult = {
+    ok: true;
+    bytes: Uint8Array;
+    contentType: string;
+} | ImageTransformError;
+/** Parse Supabase Storage image query parameters without decoding the source. */
+export declare function parseImageTransform(query: URLSearchParams): ImageTransformParseResult;
+/** Encode a transform object into the query shape used by render/image URLs. */
+export declare function imageTransformToSearchParams(options?: ImageTransformRequestOptions): URLSearchParams;
+/** Decode, resize, and encode an image using the Bun.Image-compatible subset. */
+export declare function transformImage(bytes: Uint8Array, options: ImageTransformOptions): Promise<ImageTransformResult>;
+//# sourceMappingURL=image-transform.d.ts.map

package/dist/vendor/tinbase/storage/image-transform.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"image-transform.d.ts","sourceRoot":"","sources":["../../../../src/vendor/tinbase/storage/image-transform.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,MAAM,CAAA;AACrD,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,CAAA;AAErE,MAAM,WAAW,qBAAqB;IACpC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,oBAAoB,CAAA;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,oBAAoB,CAAA;CAC7B;AAED,MAAM,WAAW,4BAA4B;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAA;IACvC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,oBAAoB,CAAA;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,KAAK,CAAA;IACT,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAA;IAC7B,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,MAAM,yBAAyB,GACjC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,qBAAqB,CAAA;CAAE,GAC1C,mBAAmB,CAAA;AAEvB,MAAM,MAAM,oBAAoB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,UAAU,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACpD,mBAAmB,CAAA;AA2CvB,iFAAiF;AACjF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,eAAe,GAAG,yBAAyB,CA6BrF;AAED,gFAAgF;AAChF,wBAAgB,4BAA4B,CAAC,OAAO,CAAC,EAAE,4BAA4B,GAAG,eAAe,CASpG;AAwDD,iFAAiF;AACjF,wBAAsB,cAAc,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA6CrH"}

package/dist/vendor/tinbase/storage/s3-driver.d.ts

@@ -0,0 +1,36 @@
+import type { StorageDriver } from '../types.js';
+export interface S3StorageDriverOptions {
+    bucket?: string;
+    prefix?: string;
+    endpoint?: string;
+    region?: string;
+    accessKeyId?: string;
+    secretAccessKey?: string;
+    sessionToken?: string;
+    virtualHostedStyle?: boolean;
+    partSize?: number;
+    queueSize?: number;
+    retry?: number;
+    requestPayer?: boolean;
+}
+export interface S3StorageFileLike {
+    exists(): Promise<boolean>;
+    bytes(): Promise<Uint8Array>;
+    write(data: Uint8Array): Promise<unknown>;
+    delete(): Promise<void>;
+}
+export interface S3StorageClientLike {
+    file(path: string): S3StorageFileLike;
+}
+export declare class S3StorageDriver implements StorageDriver {
+    readonly cleanupFailureMode: "propagate";
+    private readonly client;
+    private readonly prefix;
+    constructor(options?: S3StorageDriverOptions, client?: S3StorageClientLike);
+    put(key: string, data: Uint8Array): Promise<void>;
+    get(key: string): Promise<Uint8Array | null>;
+    delete(key: string): Promise<void>;
+    deleteMany(keys: string[]): Promise<void>;
+    private objectKey;
+}
+//# sourceMappingURL=s3-driver.d.ts.map

package/dist/vendor/tinbase/storage/s3-driver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3-driver.d.ts","sourceRoot":"","sources":["../../../../src/vendor/tinbase/storage/s3-driver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAEhD,MAAM,WAAW,sBAAsB;IACrC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;IAC1B,KAAK,IAAI,OAAO,CAAC,UAAU,CAAC,CAAA;IAC5B,KAAK,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACzC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,CAAA;CACtC;AA4DD,qBAAa,eAAgB,YAAW,aAAa;IACnD,QAAQ,CAAC,kBAAkB,EAAG,WAAW,CAAS;IAClD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;IAC5C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAQ;gBAEnB,OAAO,GAAE,sBAA2B,EAAE,MAAM,CAAC,EAAE,mBAAmB;IAMxE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjD,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAY5C,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAM/C,OAAO,CAAC,SAAS;CAGlB"}