@supacloud/lite 0.23.0 → 0.25.0

package/dist/index.js

@@ -49,6 +49,8 @@ async function verifyJwt(token, secret) {
   if (parts.length !== 3)
     return null;
   const [header, payload, signature] = parts;
+  if (!header || !payload || !signature)
+    return null;
   try {
     const head = JSON.parse(decoder.decode(base64UrlToBytes(header)));
     if (head.alg !== "HS256")
@@ -69,8 +71,11 @@ function decodeJwt(token) {
   const parts = token.split(".");
   if (parts.length !== 3)
     return null;
+  const payload = parts[1];
+  if (!payload)
+    return null;
   try {
-    return JSON.parse(decoder.decode(base64UrlToBytes(parts[1])));
+    return JSON.parse(decoder.decode(base64UrlToBytes(payload)));
   } catch {
     return null;
   }
@@ -83,7 +88,7 @@ function randomToken(bytes = 32) {
 // package.json
 var package_default = {
   name: "@supacloud/lite",
-  version: "0.23.0",
+  version: "0.25.0",
   description: "Bun-native, single-project Supabase-compatible backend powered by PGlite or native PostgreSQL",
   type: "module",
   license: "Apache-2.0",
@@ -149,7 +154,7 @@ var package_default = {
     "@supacloud/elysia": "file:../elysia",
     "@supabase/supabase-js": "^2.117.3",
     "@types/bun": "^1.4.2",
-    effect: "3.22.1",
+    effect: "4.0.2",
     elysia: "2.0.0-beta.21",
     jose: "^6.2.11",
     typescript: "^7.0.2"
@@ -192,7 +197,7 @@ var SUPACLOUD_LITE_VERSION = package_default.version;
 function globToRegExp(pattern) {
   let out = "";
   for (let i = 0;i < pattern.length; i++) {
-    const c = pattern[i];
+    const c = pattern.charAt(i);
     if (c === "*") {
       if (pattern[i + 1] === "*") {
         out += ".*";
@@ -245,11 +250,11 @@ var PRESETS = {
     userInfoUrl: "https://openidconnect.googleapis.com/v1/userinfo",
     scopes: "openid email profile",
     profileMap: (r) => ({
-      id: r.sub,
-      email: r.email,
-      emailVerified: r.email_verified === true,
-      name: r.name,
-      metadata: { avatar_url: r.picture, full_name: r.name }
+      id: typeof r["sub"] === "string" ? r["sub"] : "",
+      ...typeof r["email"] === "string" ? { email: r["email"] } : {},
+      emailVerified: r["email_verified"] === true,
+      ...typeof r["name"] === "string" ? { name: r["name"] } : {},
+      metadata: { avatar_url: r["picture"], full_name: r["name"] }
     })
   },
   github: {
@@ -257,7 +262,12 @@ var PRESETS = {
     tokenUrl: "https://github.com/login/oauth/access_token",
     userInfoUrl: "https://api.github.com/user",
     scopes: "read:user user:email",
-    profileMap: (r) => ({ id: String(r.id), email: r.email, name: r.name ?? r.login, metadata: { avatar_url: r.avatar_url, user_name: r.login } })
+    profileMap: (r) => ({
+      id: String(r["id"]),
+      ...typeof r["email"] === "string" ? { email: r["email"] } : {},
+      ...typeof r["name"] === "string" || typeof r["login"] === "string" ? { name: typeof r["name"] === "string" ? r["name"] : r["login"] } : {},
+      metadata: { avatar_url: r["avatar_url"], user_name: r["login"] }
+    })
   }
 };
 function resolveProvider(name, cfg) {
@@ -276,7 +286,11 @@ function resolveProvider(name, cfg) {
     tokenUrl,
     userInfoUrl,
     scopes: cfg.scopes ?? preset.scopes ?? "",
-    profileMap: cfg.profileMap ?? preset.profileMap ?? ((r) => ({ id: String(r.id ?? r.sub), email: r.email, name: r.name }))
+    profileMap: cfg.profileMap ?? preset.profileMap ?? ((r) => ({
+      id: String(r["id"] ?? r["sub"]),
+      ...typeof r["email"] === "string" ? { email: r["email"] } : {},
+      ...typeof r["name"] === "string" ? { name: r["name"] } : {}
+    }))
   };
 }
 
@@ -972,41 +986,41 @@ var DEFAULT_AUTH_SETTINGS = {
 };
 function sanitize(raw) {
   const s = { ...DEFAULT_AUTH_SETTINGS };
-  if (typeof raw.disableSignup === "boolean")
-    s.disableSignup = raw.disableSignup;
-  if (typeof raw.anonymousUsers === "boolean")
-    s.anonymousUsers = raw.anonymousUsers;
-  if (typeof raw.autoconfirm === "boolean")
-    s.autoconfirm = raw.autoconfirm;
-  if (typeof raw.minPasswordLength === "number" && Number.isFinite(raw.minPasswordLength)) {
-    s.minPasswordLength = Math.max(4, Math.min(72, Math.floor(raw.minPasswordLength)));
-  }
-  if (Array.isArray(raw.disabledProviders)) {
-    s.disabledProviders = raw.disabledProviders.filter((p) => typeof p === "string").slice(0, 50);
-  }
-  if (typeof raw.otpLength === "number" && Number.isFinite(raw.otpLength)) {
-    s.otpLength = Math.max(6, Math.min(10, Math.floor(raw.otpLength)));
-  }
-  if (typeof raw.otpExpirySeconds === "number" && Number.isFinite(raw.otpExpirySeconds) && raw.otpExpirySeconds > 0) {
-    s.otpExpirySeconds = Math.floor(raw.otpExpirySeconds);
-  }
-  if (typeof raw.smsEnabled === "boolean")
-    s.smsEnabled = raw.smsEnabled;
-  if (typeof raw.smsSignupEnabled === "boolean")
-    s.smsSignupEnabled = raw.smsSignupEnabled;
-  if (typeof raw.smsOtpCooldownSeconds === "number" && Number.isFinite(raw.smsOtpCooldownSeconds)) {
-    s.smsOtpCooldownSeconds = Math.max(0, Math.min(86400, Math.floor(raw.smsOtpCooldownSeconds)));
-  }
-  if (typeof raw.smsTemplate === "string" && raw.smsTemplate.length > 0 && raw.smsTemplate.length <= 1000 && /\{\{\s*\.Code\s*\}\}/.test(raw.smsTemplate)) {
-    s.smsTemplate = raw.smsTemplate;
-  }
-  if (typeof raw.maxEnrolledFactors === "number" && Number.isFinite(raw.maxEnrolledFactors) && raw.maxEnrolledFactors > 0) {
-    s.maxEnrolledFactors = Math.floor(raw.maxEnrolledFactors);
-  }
-  if (typeof raw.totpEnrollEnabled === "boolean")
-    s.totpEnrollEnabled = raw.totpEnrollEnabled;
-  if (typeof raw.totpVerifyEnabled === "boolean")
-    s.totpVerifyEnabled = raw.totpVerifyEnabled;
+  if (typeof raw["disableSignup"] === "boolean")
+    s.disableSignup = raw["disableSignup"];
+  if (typeof raw["anonymousUsers"] === "boolean")
+    s.anonymousUsers = raw["anonymousUsers"];
+  if (typeof raw["autoconfirm"] === "boolean")
+    s.autoconfirm = raw["autoconfirm"];
+  if (typeof raw["minPasswordLength"] === "number" && Number.isFinite(raw["minPasswordLength"])) {
+    s.minPasswordLength = Math.max(4, Math.min(72, Math.floor(raw["minPasswordLength"])));
+  }
+  if (Array.isArray(raw["disabledProviders"])) {
+    s.disabledProviders = raw["disabledProviders"].filter((p) => typeof p === "string").slice(0, 50);
+  }
+  if (typeof raw["otpLength"] === "number" && Number.isFinite(raw["otpLength"])) {
+    s.otpLength = Math.max(6, Math.min(10, Math.floor(raw["otpLength"])));
+  }
+  if (typeof raw["otpExpirySeconds"] === "number" && Number.isFinite(raw["otpExpirySeconds"]) && raw["otpExpirySeconds"] > 0) {
+    s.otpExpirySeconds = Math.floor(raw["otpExpirySeconds"]);
+  }
+  if (typeof raw["smsEnabled"] === "boolean")
+    s.smsEnabled = raw["smsEnabled"];
+  if (typeof raw["smsSignupEnabled"] === "boolean")
+    s.smsSignupEnabled = raw["smsSignupEnabled"];
+  if (typeof raw["smsOtpCooldownSeconds"] === "number" && Number.isFinite(raw["smsOtpCooldownSeconds"])) {
+    s.smsOtpCooldownSeconds = Math.max(0, Math.min(86400, Math.floor(raw["smsOtpCooldownSeconds"])));
+  }
+  if (typeof raw["smsTemplate"] === "string" && raw["smsTemplate"].length > 0 && raw["smsTemplate"].length <= 1000 && /\{\{\s*\.Code\s*\}\}/.test(raw["smsTemplate"])) {
+    s.smsTemplate = raw["smsTemplate"];
+  }
+  if (typeof raw["maxEnrolledFactors"] === "number" && Number.isFinite(raw["maxEnrolledFactors"]) && raw["maxEnrolledFactors"] > 0) {
+    s.maxEnrolledFactors = Math.floor(raw["maxEnrolledFactors"]);
+  }
+  if (typeof raw["totpEnrollEnabled"] === "boolean")
+    s.totpEnrollEnabled = raw["totpEnrollEnabled"];
+  if (typeof raw["totpVerifyEnabled"] === "boolean")
+    s.totpVerifyEnabled = raw["totpVerifyEnabled"];
   return s;
 }
 async function loadAuthSettings(db, defaults = {}) {
@@ -1047,7 +1061,7 @@ class RateLimiter {
     const cutoff = now - rule.windowMs;
     const recent = (this.hits.get(bucketKey) ?? []).filter((t) => t > cutoff);
     if (recent.length >= rule.limit) {
-      const retryMs = recent[0] + rule.windowMs - now;
+      const retryMs = (recent[0] ?? now) + rule.windowMs - now;
       return Math.max(1, Math.ceil(retryMs / 1000));
     }
     recent.push(now);
@@ -1879,13 +1893,14 @@ Or sign in with this link: ${link}`
       const body = await req.json().catch(() => ({}));
       if (!body.email)
         return authError(400, "validation_failed", "email is required");
+      const email = body.email;
       const hashed = body.password ? await hashPassword(body.password) : null;
       const created = await this.db.transaction(async (query) => {
         const res = await query(`insert into auth.users
              (aud, role, email, encrypted_password, email_confirmed_at, raw_app_meta_data, raw_user_meta_data)
            values ('authenticated', 'authenticated', $1, $2, case when $3 then now() else null end, $4, $5)
            returning *`, [
-          body.email.toLowerCase().trim(),
+          email.toLowerCase().trim(),
           hashed,
           body.email_confirm ?? true,
           JSON.stringify({ provider: "email", providers: ["email"], ...body.app_metadata ?? {} }),
@@ -2548,11 +2563,11 @@ function installDenoShim() {
 }
 function takeCapturedHandler() {
   const h = captured.handler;
-  captured.handler = undefined;
+  delete captured.handler;
   return h;
 }
 function resetCapturedHandler() {
-  captured.handler = undefined;
+  delete captured.handler;
 }
 
 // src/runtime/functions/edge-runtime-shim.ts
@@ -2576,7 +2591,7 @@ function installEdgeRuntimeShim() {
     }
   };
   installed = runtime;
-  globalThis.EdgeRuntime = runtime;
+  globalThis["EdgeRuntime"] = runtime;
 }
 function runWithBackgroundTasks(options, fn) {
   installEdgeRuntimeShim();
@@ -2948,9 +2963,13 @@ class FunctionsHandler {
       const env = capabilities?.secrets ? filterSecretsEnv(this.env, capabilities.secrets) : this.env;
       const invoke = () => this.invoke(entry.handler, request, ctx, env);
       const inner = () => runWithDenoEnv(env, () => runWithPgredisCache(this.pgredis, invoke));
-      const run = capabilities?.outboundHosts ? () => runWithFetchPolicy(capabilities.outboundHosts, inner) : inner;
-      const invokeWithBackground = () => runWithBackgroundTasks({ allowed: capabilities?.background !== false, timeoutMs: limits?.waitUntilTimeoutMs }, run);
-      const res = timeoutMs !== undefined ? await this.withTimeout(name, timeoutMs, invokeWithBackground, abort) : await invokeWithBackground();
+      const outboundHosts = capabilities?.outboundHosts;
+      const run = outboundHosts ? () => runWithFetchPolicy(outboundHosts, inner) : inner;
+      const invokeWithBackground = () => runWithBackgroundTasks({
+        allowed: capabilities?.background !== false,
+        ...limits?.waitUntilTimeoutMs === undefined ? {} : { timeoutMs: limits.waitUntilTimeoutMs }
+      }, run);
+      const res = timeoutMs !== undefined && abort !== undefined ? await this.withTimeout(name, timeoutMs, invokeWithBackground, abort) : await invokeWithBackground();
       if (!(res instanceof Response)) {
         return json2(500, { error: `function "${name}" did not return a Response` });
       }
@@ -3018,6 +3037,8 @@ function withCountedBody(req, limit) {
       controller.enqueue(chunk);
     }
   });
+  if (!req.body)
+    return new Request(req);
   return new Request(req, { body: req.body.pipeThrough(counter), duplex: "half" });
 }
 function withResponseLimit(name, res, limit) {
@@ -6353,7 +6374,7 @@ async function createPgliteEngine(dataDir, options = {}) {
   let pg;
   try {
     pg = new PGlite({
-      dataDir,
+      ...dataDir === undefined ? {} : { dataDir },
       extensions,
       ...standaloneAssets ? {
         pgliteWasmModule: standaloneAssets.pgliteWasmModule,
@@ -6382,7 +6403,7 @@ async function createPgliteEngine(dataDir, options = {}) {
   return {
     async query(sql, params) {
       const res = await pg.query(sql, params);
-      return { rows: res.rows, affectedRows: res.affectedRows };
+      return { rows: res.rows, ...res.affectedRows === undefined ? {} : { affectedRows: res.affectedRows } };
     },
     async exec(sql) {
       await pg.exec(sql);
@@ -6392,7 +6413,7 @@ async function createPgliteEngine(dataDir, options = {}) {
         return fn({
           async query(sql, params) {
             const res = await tx.query(sql, params);
-            return { rows: res.rows, affectedRows: res.affectedRows };
+            return { rows: res.rows, ...res.affectedRows === undefined ? {} : { affectedRows: res.affectedRows } };
           },
           async exec(sql) {
             await tx.exec(sql);
@@ -6421,8 +6442,8 @@ function getStandaloneAssets() {
 function withEmbeddedBundle(extension, bundlePath) {
   return {
     ...extension,
-    setup: async (pg, emscriptenOpts, clientOnly) => ({
-      ...await extension.setup(pg, emscriptenOpts, clientOnly),
+    setup: async (...args) => ({
+      ...await extension.setup(...args),
       bundlePath
     })
   };
@@ -6646,12 +6667,17 @@ class Database {
        order by kcu.constraint_name, kcu.ordinal_position`, [schema]);
     const uniqByTable = new Map;
     for (const u of uniq.rows) {
-      if (!uniqByTable.has(u.table_name))
-        uniqByTable.set(u.table_name, new Map);
-      const byConstraint = uniqByTable.get(u.table_name);
-      if (!byConstraint.has(u.constraint_name))
-        byConstraint.set(u.constraint_name, []);
-      byConstraint.get(u.constraint_name).push(u.column_name);
+      let byConstraint = uniqByTable.get(u.table_name);
+      if (!byConstraint) {
+        byConstraint = new Map;
+        uniqByTable.set(u.table_name, byConstraint);
+      }
+      let columns = byConstraint.get(u.constraint_name);
+      if (!columns) {
+        columns = [];
+        byConstraint.set(u.constraint_name, columns);
+      }
+      columns.push(u.column_name);
     }
     const fks = await this.engine.query(`select
          tc.constraint_name,
@@ -6672,22 +6698,27 @@ class Database {
        order by tc.constraint_name, kcu.ordinal_position`, [schema]);
     const pkSet = new Map;
     for (const pk of pks.rows) {
-      if (!pkSet.has(pk.table_name))
-        pkSet.set(pk.table_name, new Set);
-      pkSet.get(pk.table_name).add(pk.column_name);
+      let columns = pkSet.get(pk.table_name);
+      if (!columns) {
+        columns = new Set;
+        pkSet.set(pk.table_name, columns);
+      }
+      columns.add(pk.column_name);
     }
     const tables = new Map;
     for (const c of cols.rows) {
-      if (!tables.has(c.table_name)) {
-        tables.set(c.table_name, {
+      let table = tables.get(c.table_name);
+      if (!table) {
+        table = {
           schema,
           name: c.table_name,
           columns: [],
           primaryKey: [...pkSet.get(c.table_name) ?? []],
           uniqueKeys: [...uniqByTable.get(c.table_name)?.values() ?? []]
-        });
+        };
+        tables.set(c.table_name, table);
       }
-      tables.get(c.table_name).columns.push({
+      table.columns.push({
         name: c.column_name,
         udtName: c.udt_name,
         isNullable: c.is_nullable === "YES",
@@ -6859,12 +6890,15 @@ function parseIdentityArgs(identity) {
     parts.push(current);
   return parts.map((part) => {
     const tokens = part.trim().split(/\s+/);
-    while (tokens.length > 1 && ["IN", "OUT", "INOUT", "VARIADIC"].includes(tokens[0])) {
+    while (tokens.length > 1 && ["IN", "OUT", "INOUT", "VARIADIC"].includes(tokens[0] ?? "")) {
       tokens.shift();
     }
+    const first = tokens[0];
+    if (first === undefined || first === "")
+      throw new Error("invalid function identity argument");
     if (tokens.length === 1)
-      return { name: "", type: tokens[0] };
-    const name = tokens[0].replace(/^"|"$/g, "");
+      return { name: "", type: first };
+    const name = first.replace(/^"|"$/g, "");
     return { name, type: tokens.slice(1).join(" ") };
   });
 }
@@ -7176,6 +7210,8 @@ class RealtimeEngine {
     const state = this.presence.get(topic);
     if (state?.has(channel.presenceKey)) {
       const metas = state.get(channel.presenceKey);
+      if (!metas)
+        return;
       state.delete(channel.presenceKey);
       if (state.size === 0)
         this.presence.delete(topic);
@@ -7470,7 +7506,7 @@ class ApiError extends Error {
   status;
   body;
   constructor(status, body) {
-    super(typeof body.message === "string" ? body.message : JSON.stringify(body));
+    super(typeof body["message"] === "string" ? body["message"] : JSON.stringify(body));
     this.status = status;
     this.body = body;
   }
@@ -7848,6 +7884,8 @@ class QueryBuilder {
       const cells = columns.map((c) => {
         if (!(c in row)) {
           const col = tinfo.columns.find((x) => x.name === c);
+          if (!col)
+            throw new ApiError(400, { code: "PGRST204", message: `Column ${c} does not exist` });
           return opts.missingDefault && col.hasDefault ? "default" : "null";
         }
         return this.pushParam(params, tinfo, c, row[c]);
@@ -7967,6 +8005,8 @@ class QueryBuilder {
       });
     } else {
       const j = rel.junction;
+      if (!j)
+        throw new Error("many-to-many relationship is missing its junction table");
       const jAlias = this.nextAlias();
       const joinConds = j.fkToTarget.srcColumns.map((src, i) => `${quoteIdent(jAlias)}.${quoteIdent(src)} = ${quoteIdent(childAlias)}.${quoteIdent(j.fkToTarget.tgtColumns[i])}`);
       fromClause = `${this.qualify(rel.targetTable)} as ${quoteIdent(childAlias)} join ${this.qualify(j.table)} as ${quoteIdent(jAlias)} on ${joinConds.join(" and ")}`;
@@ -8232,6 +8272,8 @@ function renderFilter(f, alias) {
     case "phfts":
     case "wfts": {
       const fn = { fts: "to_tsquery", plfts: "plainto_tsquery", phfts: "phraseto_tsquery", wfts: "websearch_to_tsquery" }[f.op];
+      if (!fn)
+        throw new Error(`Unsupported full-text operator: ${f.op}`);
       expr = f.ftsConfig ? `${colExpr} @@ ${fn}(${quoteLiteral(f.ftsConfig)}, ${quoteLiteral(f.value)})` : `${colExpr} @@ ${fn}(${quoteLiteral(f.value)})`;
       break;
     }
@@ -8526,9 +8568,10 @@ class RestHandler {
     if (!opts.returning) {
       return new Response(null, { status: opts.status === 201 ? 201 : 204, headers: countHeader });
     }
-    return this.dataResponse(rows, {
+    const responseRows = rows ?? [];
+    return this.dataResponse(responseRows, {
       status: opts.status,
-      count: opts.prefer.count !== undefined ? rows.length : null,
+      count: opts.prefer.count !== undefined ? responseRows.length : null,
       offset: 0,
       wantsObject: opts.wantsObject,
       wantsCsv: opts.wantsCsv,
@@ -8639,7 +8682,7 @@ class RestHandler {
       if (item.name === "*") {
         exprs.push(`${quoteIdent(alias)}.*`);
       } else {
-        const out = item.alias ?? item.name.split(/->>|->/).pop().trim();
+        const out = item.alias ?? (item.name.split(/->>|->/).pop() ?? item.name).trim();
         const cast = item.cast ? `::${sanitizeCast(item.cast)}` : "";
         exprs.push(`${renderColumnExpr(alias, item.name)}${cast} as ${quoteIdent(out)}`);
       }
@@ -8893,7 +8936,10 @@ function applyResize(image, metadata, options) {
     image.resize(options.width);
     return;
   }
-  const proportionalWidth = Math.max(1, Math.round(metadata.width * options.height / metadata.height));
+  const height = options.height;
+  if (height === undefined)
+    return;
+  const proportionalWidth = Math.max(1, Math.round(metadata.width * height / metadata.height));
   image.resize(proportionalWidth);
 }
 async function transformImage(source, options, knownSourceSize) {
@@ -9050,6 +9096,8 @@ class ImageTransformCache {
       if (oldestKey === undefined)
         break;
       const oldest = this.entries.get(oldestKey);
+      if (!oldest)
+        break;
       this.entries.delete(oldestKey);
       this.cachedBytes -= oldest.size;
     }
@@ -9899,8 +9947,9 @@ class StorageHandler {
       ...[...folders].map((name) => ({ name, row: null })),
       ...Object.entries(files).map(([name, row]) => ({ name, row }))
     ];
-    if (body.search)
-      entries = entries.filter((e) => e.name.includes(body.search));
+    const search = body.search;
+    if (search)
+      entries = entries.filter((e) => e.name.includes(search));
     const column = body.sortBy?.column ?? "name";
     const asc = (body.sortBy?.order ?? "asc") === "asc";
     entries.sort((a, b) => {
@@ -10050,6 +10099,8 @@ function parseSizeLimit(v) {
   if (!m)
     throw new StorageValidationError(`invalid file_size_limit: ${v}`);
   const mult = { b: 1, kb: 1024, mb: 1024 ** 2, gb: 1024 ** 3 }[(m[2] ?? "b").toLowerCase()];
+  if (mult === undefined)
+    throw new StorageValidationError(`invalid file_size_limit: ${v}`);
   return Math.floor(parseFloat(m[1]) * mult);
 }
 function objectMetadata(size, contentType, cacheControl) {
@@ -10348,7 +10399,7 @@ class NetService {
       const res = await guardedFetch(this.fetchImpl, row.url, {
         method: row.method,
         headers,
-        body: hasBody ? row.body ?? undefined : undefined,
+        ...hasBody && row.body !== null ? { body: row.body } : {},
         signal: controller.signal
       });
       status = res.status;
@@ -10367,9 +10418,9 @@ class NetService {
       id: row.id,
       method: row.method,
       url: row.url,
-      status: status ?? undefined,
+      ...status === null ? {} : { status },
       timedOut,
-      error: errorMsg ?? undefined
+      ...errorMsg === null ? {} : { error: errorMsg }
     });
   }
   async record(id, status, contentType, respHeaders, content, timedOut, errorMsg) {
@@ -10822,16 +10873,16 @@ class GraphqlHandler {
         throw new ApiError(415, { message: "GraphQL requests require application/json" });
       }
       const body = JSON.parse(await boundedBody(request, this.maxBytes));
-      if (!isObject(body) || typeof body.query !== "string" || !body.query.trim() || body.variables != null && !isObject(body.variables) || body.extensions != null && !isObject(body.extensions) || body.operationName != null && typeof body.operationName !== "string") {
+      if (!isObject(body) || typeof body["query"] !== "string" || !body["query"].trim() || body["variables"] != null && !isObject(body["variables"]) || body["extensions"] != null && !isObject(body["extensions"]) || body["operationName"] != null && typeof body["operationName"] !== "string") {
         throw new ApiError(400, { message: "Invalid GraphQL request" });
       }
-      operationName = body.operationName ?? undefined;
+      operationName = body["operationName"] ?? undefined;
       const result = await this.db.withContext(context, async (query) => {
         await query(`select set_config('statement_timeout', $1, true)`, [String(this.timeoutMs)]);
         await query(`select set_config('search_path', $1, true)`, [
           this.schemas.map((schema) => `"${schema.replaceAll('"', '""')}"`).join(",")
         ]);
-        return query("select graphql.resolve($1::text, $2::jsonb, $3::text, $4::jsonb) as result", [body.query, JSON.stringify(body.variables ?? {}), body.operationName ?? null, JSON.stringify(body.extensions ?? {})]);
+        return query("select graphql.resolve($1::text, $2::jsonb, $3::text, $4::jsonb) as result", [body["query"], JSON.stringify(body["variables"] ?? {}), body["operationName"] ?? null, JSON.stringify(body["extensions"] ?? {})]);
       });
       const row = result.rows[0];
       if (result.rows.length !== 1 || !isRecord(row) || !isGraphqlEnvelope(row["result"])) {
@@ -10969,9 +11020,12 @@ async function generateTypes(db, schema = "public") {
   const views = new Map;
   for (const c of cols) {
     const target = c.table_kind === "r" ? tables : views;
-    if (!target.has(c.table_name))
-      target.set(c.table_name, []);
-    target.get(c.table_name).push(c);
+    let columns = target.get(c.table_name);
+    if (!columns) {
+      columns = [];
+      target.set(c.table_name, columns);
+    }
+    columns.push(c);
   }
   const tsType = (udt, nullable) => {
     const base = mapType(udt, enumNames, schema);
@@ -11840,7 +11894,11 @@ async function revokeReplicationGrants(tx) {
   }
 }
 async function grantReplicationAllowlist(tx, tables) {
-  const schemas = uniqueSorted(tables.map((table) => table.schema));
+  const schemas = uniqueSorted(tables.map((table) => {
+    if (!table.schema)
+      throw new Error(`publication table ${table.name} has no schema`);
+    return table.schema;
+  }));
   for (const schema of schemas) {
     await tx.exec(`GRANT USAGE ON SCHEMA ${quoteIdentifier(schema)} TO ${POWERSYNC_REPLICATION_ROLE}`);
   }
@@ -11944,6 +12002,8 @@ function normalizeCidr(cidr) {
   if (!match)
     throw new Error(`invalid PowerSync client CIDR: ${cidr}`);
   const address = match[1];
+  if (!address)
+    throw new Error(`invalid PowerSync client CIDR: ${cidr}`);
   const family = isIP(address);
   const prefix = Number(match[2]);
   if (family === 0 || prefix < 0 || prefix > (family === 4 ? 32 : 128)) {
@@ -12050,12 +12110,12 @@ class PgWireClient {
             if (code === 0) {} else if (code === 3) {
               if (!needPassword())
                 return;
-              this.socket.write(message(112, cstring(opts.password)));
+              this.socket.write(message(112, cstring(opts.password ?? "")));
             } else if (code === 5) {
               if (!needPassword())
                 return;
               const salt = payload.subarray(4, 8);
-              const inner = md5Hex(Buffer.from(opts.password + opts.user, "utf8"));
+              const inner = md5Hex(Buffer.from((opts.password ?? "") + opts.user, "utf8"));
               const token = "md5" + md5Hex(Buffer.concat([Buffer.from(inner, "utf8"), salt]));
               this.socket.write(message(112, cstring(token)));
             } else if (code === 10) {
@@ -12077,6 +12137,10 @@ class PgWireClient {
                 reject(new Error("SCRAM: server nonce does not extend client nonce"));
                 return;
               }
+              if (!attrs.s || !attrs.i || !opts.password) {
+                reject(new Error("SCRAM: incomplete server challenge"));
+                return;
+              }
               const salt = Buffer.from(attrs.s, "base64");
               const iterations = parseInt(attrs.i, 10);
               const saltedPassword = pbkdf2Sync(opts.password, salt, iterations, 32, "sha256");
@@ -12493,7 +12557,7 @@ function toPgArrayLiteral(array) {
 // src/runtime/node/native/engine.ts
 var DEFAULT_PG_VERSION = "17.7.0";
 var POSTGRES_MIRROR_URL_ERROR = "SUPACLOUD_LITE_POSTGRES_MIRROR must be an absolute HTTPS URL or a loopback HTTP URL";
-var NATIVE_POSTGRES_MAJOR = DEFAULT_PG_VERSION.split(".")[0];
+var NATIVE_POSTGRES_MAJOR = DEFAULT_PG_VERSION.split(".")[0] ?? "17";
 function nativePostgresMajor(installDir = process.env.SUPACLOUD_LITE_POSTGRES_DIR) {
   if (!installDir)
     return NATIVE_POSTGRES_MAJOR;
@@ -12760,15 +12824,18 @@ ${detail}` : " (no output)"}
       connect,
       onClose: async () => {
         removeExitHandler?.();
-        await stopPostgres(postgres, () => postgresExited);
-        rmSync(socketDirectory, { recursive: true, force: true });
+        if (postgres)
+          await stopPostgres(postgres, () => postgresExited);
+        if (socketDirectory)
+          rmSync(socketDirectory, { recursive: true, force: true });
         await releaseLock();
       }
     });
   } catch (error) {
     removeExitHandler?.();
-    if (postgres)
-      await stopPostgres(postgres, () => postgres.exitCode !== null);
+    const processToStop = postgres;
+    if (processToStop)
+      await stopPostgres(processToStop, () => processToStop.exitCode !== null);
     if (socketDirectory)
       rmSync(socketDirectory, { recursive: true, force: true });
     await releaseLock();
@@ -13588,7 +13655,10 @@ ${details}`, { cause: buildThrow });
       throw new Error(buildOutput.logs.map((item) => item.message).join(`
 `) || `failed to bundle ${entryPath}`);
     }
-    return buildOutput.outputs[0].path;
+    const output = buildOutput.outputs[0];
+    if (!output)
+      throw new Error(`bundle produced no output for ${entryPath}`);
+    return output.path;
   } catch (buildError) {
     try {
       await rm2(outDir, { recursive: true, force: true });
@@ -13674,7 +13744,8 @@ async function loadFunctionsUnlocked(projectDir, options, mode) {
     const dir = join5(root, name);
     if (!(await stat(dir)).isDirectory())
       continue;
-    const candidates = options[name]?.entrypoint ? [join5(projectDir, options[name].entrypoint)] : ["index.ts", "index.tsx", "index.js", "index.mjs"].map((f) => join5(dir, f));
+    const entrypoint = options[name]?.entrypoint;
+    const candidates = entrypoint ? [join5(projectDir, entrypoint)] : ["index.ts", "index.tsx", "index.js", "index.mjs"].map((f) => join5(dir, f));
     for (const path of candidates) {
       try {
         await stat(path);

package/dist/runtime/auth/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/runtime/auth/handler.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAW,MAAM,mBAAmB,CAAA;AAE1D,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAc,SAAS,EAAE,MAAM,aAAa,CAAA;AAEhF,OAAO,EAAgB,KAAK,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAGnE,OAAO,EAAyB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAA;AAExE,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAG7C,wDAAwD;AACxD,MAAM,WAAW,UAAU;IACzB,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAA;IACjB,2FAA2F;IAC3F,MAAM,EAAE,MAAM,CAAA;IACd,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAA;IACf,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAA;IACjB,yGAAyG;IACzG,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,uEAAuE;IACvE,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAA;IACd,+DAA+D;IAC/D,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAAA;IAC5B,oFAAoF;IACpF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;IAC/B,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;IACpD,gFAAgF;IAChF,UAAU,CAAC,EAAE,OAAO,KAAK,CAAA;IACzB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAA;IAClC;;;OAGG;IACH,QAAQ,CAAC,EAAE,YAAY,CAAA;IACvB;;;OAGG;IACH,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAA;CACjC;AAED,UAAU,OAAO;IACf,EAAE,EAAE,MAAM,CAAA;IACV,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,kBAAkB,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IACxC,eAAe,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IACrC,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IACjD,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IAClD,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAChC,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAChC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,kBAAkB,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IACxC,YAAY,EAAE,OAAO,GAAG,IAAI,CAAA;IAC5B,YAAY,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAClC,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;CACjC;AAgID,wEAAwE;AACxE,qBAAa,WAAW;IAYpB,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,MAAM;IAZhB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAS;IAC1D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAM;IACrD,OAAO,CAAC,KAAK,CAAc;IAC3B,8EAA8E;IAC9E,OAAO,CAAC,QAAQ,CAAc;IAC9B,OAAO,CAAC,WAAW,CAAoB;IACvC,OAAO,CAAC,eAAe,CAA2B;IAClD,OAAO,CAAC,wBAAwB,CAA6B;IAC7D,OAAO,CAAC,QAAQ,CAAQ;gBAGd,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,UAAU;IAe5B;;;OAGG;IACH,OAAO,CAAC,KAAK;IAKb,OAAO,CAAC,QAAQ;IAUhB,4EAA4E;IACtE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAQb,oCAAoC;IAgBlD,8FAA8F;IACxF,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;YA0D9D,gBAAgB;YAYhB,MAAM;YAiEN,KAAK;YAwCL,OAAO;YAMP,UAAU;YA6DV,MAAM;YAwBN,UAAU;YA4CV,OAAO;YAqBP,eAAe;YAqDf,eAAe;YAmCf,SAAS;YAwBT,kBAAkB;IAShC,OAAO,CAAC,mBAAmB;YASb,eAAe;YAgBf,YAAY;YAaZ,qBAAqB;YAgBrB,qBAAqB;IAUnC,OAAO,CAAC,kBAAkB;IAM1B,OAAO,CAAC,kBAAkB;YAQZ,YAAY;IAM1B,+EAA+E;IAC/E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAI;YAE9B,MAAM;YASN,eAAe;YAWf,uBAAuB;YAkBvB,qBAAqB;YAUrB,uBAAuB;YAcvB,6BAA6B;YAa7B,WAAW;YAsCX,cAAc;YAyDd,UAAU;YAuBV,KAAK;YAyHL,sBAAsB;IAuEpC;;;OAGG;YACW,KAAK;IAqBnB;;;;;OAKG;YACW,UAAU;IA2CxB;;;;;;;;;OASG;YACW,SAAS;YAqBT,YAAY;YAyDZ,eAAe;YAqBf,YAAY;YAmDZ,cAAc;YAWd,cAAc;IAmB5B,oFAAoF;YACtE,iBAAiB;YAqBjB,mBAAmB;YAcnB,qBAAqB;YAarB,kBAAkB;YAqBlB,iBAAiB;YAUjB,uBAAuB;IASrC,OAAO,CAAC,kBAAkB;YAoBZ,cAAc;YAOd,gBAAgB;IAM9B,wEAAwE;IACxE,QAAQ,CACN,CAAC,EAAE,OAAO,EACV,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAO,EACvC,UAAU,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAO,GACzC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAqB1B,OAAO,CAAC,eAAe;YAMT,qBAAqB;YAYrB,UAAU;CAqDzB"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/runtime/auth/handler.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAW,MAAM,mBAAmB,CAAA;AAE1D,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAc,SAAS,EAAE,MAAM,aAAa,CAAA;AAEhF,OAAO,EAAgB,KAAK,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAGnE,OAAO,EAAyB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAA;AAExE,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAG7C,wDAAwD;AACxD,MAAM,WAAW,UAAU;IACzB,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAA;IACjB,2FAA2F;IAC3F,MAAM,EAAE,MAAM,CAAA;IACd,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAA;IACf,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAA;IACjB,yGAAyG;IACzG,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,uEAAuE;IACvE,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAA;IACd,+DAA+D;IAC/D,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAAA;IAC5B,oFAAoF;IACpF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;IAC/B,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;IACpD,gFAAgF;IAChF,UAAU,CAAC,EAAE,OAAO,KAAK,CAAA;IACzB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAA;IAClC;;;OAGG;IACH,QAAQ,CAAC,EAAE,YAAY,CAAA;IACvB;;;OAGG;IACH,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAA;CACjC;AAED,UAAU,OAAO;IACf,EAAE,EAAE,MAAM,CAAA;IACV,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,kBAAkB,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IACxC,eAAe,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IACrC,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IACjD,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IAClD,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAChC,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAChC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,kBAAkB,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IACxC,YAAY,EAAE,OAAO,GAAG,IAAI,CAAA;IAC5B,YAAY,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;IAClC,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;CACjC;AAgID,wEAAwE;AACxE,qBAAa,WAAW;IAYpB,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,MAAM;IAZhB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAS;IAC1D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAM;IACrD,OAAO,CAAC,KAAK,CAAc;IAC3B,8EAA8E;IAC9E,OAAO,CAAC,QAAQ,CAAc;IAC9B,OAAO,CAAC,WAAW,CAAoB;IACvC,OAAO,CAAC,eAAe,CAA2B;IAClD,OAAO,CAAC,wBAAwB,CAA6B;IAC7D,OAAO,CAAC,QAAQ,CAAQ;gBAGd,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,UAAU;IAe5B;;;OAGG;IACH,OAAO,CAAC,KAAK;IAKb,OAAO,CAAC,QAAQ;IAUhB,4EAA4E;IACtE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAQb,oCAAoC;IAgBlD,8FAA8F;IACxF,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;YA0D9D,gBAAgB;YAYhB,MAAM;YAiEN,KAAK;YAwCL,OAAO;YAMP,UAAU;YA6DV,MAAM;YAwBN,UAAU;YA4CV,OAAO;YAqBP,eAAe;YAqDf,eAAe;YAmCf,SAAS;YAwBT,kBAAkB;IAShC,OAAO,CAAC,mBAAmB;YASb,eAAe;YAgBf,YAAY;YAaZ,qBAAqB;YAgBrB,qBAAqB;IAUnC,OAAO,CAAC,kBAAkB;IAM1B,OAAO,CAAC,kBAAkB;YAQZ,YAAY;IAM1B,+EAA+E;IAC/E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAI;YAE9B,MAAM;YASN,eAAe;YAWf,uBAAuB;YAkBvB,qBAAqB;YAUrB,uBAAuB;YAcvB,6BAA6B;YAa7B,WAAW;YAsCX,cAAc;YAyDd,UAAU;YAuBV,KAAK;YA0HL,sBAAsB;IAuEpC;;;OAGG;YACW,KAAK;IAqBnB;;;;;OAKG;YACW,UAAU;IA2CxB;;;;;;;;;OASG;YACW,SAAS;YAqBT,YAAY;YAyDZ,eAAe;YAqBf,YAAY;YAmDZ,cAAc;YAWd,cAAc;IAmB5B,oFAAoF;YACtE,iBAAiB;YAqBjB,mBAAmB;YAcnB,qBAAqB;YAarB,kBAAkB;YAqBlB,iBAAiB;YAUjB,uBAAuB;IASrC,OAAO,CAAC,kBAAkB;YAoBZ,cAAc;YAOd,gBAAgB;IAM9B,wEAAwE;IACxE,QAAQ,CACN,CAAC,EAAE,OAAO,EACV,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAO,EACvC,UAAU,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAO,GACzC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAqB1B,OAAO,CAAC,eAAe;YAMT,qBAAqB;YAYrB,UAAU;CAqDzB"}

package/dist/runtime/auth/oauth.d.ts

@@ -11,6 +11,7 @@
  *         - implicit: redirect to redirect_to#access_token=…&refresh_token=…
  */
 import type { Database } from '../db/database.js';
+type OAuthRawProfile = Record<string, unknown>;
 /** Operator-supplied config for one OAuth provider. Endpoint URLs are optional for presets (google, github). */
 export interface OAuthProviderConfig {
     /** OAuth client id issued by the provider */
@@ -26,7 +27,7 @@ export interface OAuthProviderConfig {
     /** space-separated scopes to request; falls back to the preset's */
     scopes?: string;
     /** Map the provider's raw userinfo JSON to a normalized profile. */
-    profileMap?: (raw: any) => OAuthProfile;
+    profileMap?: (raw: OAuthRawProfile) => OAuthProfile;
 }
 /** Normalized profile extracted from a provider's userinfo response. */
 export interface OAuthProfile {
@@ -43,7 +44,7 @@ export interface OAuthProfile {
 }
 interface ResolvedProvider extends Required<Omit<OAuthProviderConfig, 'profileMap'>> {
     name: string;
-    profileMap: (raw: any) => OAuthProfile;
+    profileMap: (raw: OAuthRawProfile) => OAuthProfile;
 }
 /**
  * Merge operator config with the built-in preset for `name` into a fully