@supacloud/lite 0.29.4 → 0.30.0

package/CHANGELOG.md

@@ -1,5 +1,30 @@
 # Changelog
 
+## [0.30.0](https://github.com/vibeunion/supacloud/compare/supacloud-lite-v0.29.5...supacloud-lite-v0.30.0) (2026-10-17)
+
+
+### Features
+
+* add configurable image-transformation input and output limits with a 500 MiB default and maximum ([#2027](https://github.com/vibeunion/supacloud/issues/2027)) ([5c07903](https://github.com/vibeunion/supacloud/commit/5c07903f20bfb069229cf3a829886fe96c78c288))
+
+
+### Bug Fixes
+
+* enforce account eligibility consistently for bearer, email, OAuth and refresh authentication ([#2027](https://github.com/vibeunion/supacloud/issues/2027)) ([5c07903](https://github.com/vibeunion/supacloud/commit/5c07903f20bfb069229cf3a829886fe96c78c288))
+* prepare isolated package artifacts against the current database dependency ([#2027](https://github.com/vibeunion/supacloud/issues/2027)) ([5c07903](https://github.com/vibeunion/supacloud/commit/5c07903f20bfb069229cf3a829886fe96c78c288))
+
+
+### Dependencies
+
+* align the published @supacloud/db dependency to 0.18.1.
+
+## [0.29.5](https://github.com/vibeunion/supacloud/compare/supacloud-lite-v0.29.4...supacloud-lite-v0.29.5) (2026-10-16)
+
+
+### Bug Fixes
+
+* **lite:** reject ineligible password logins ([#1998](https://github.com/vibeunion/supacloud/issues/1998)) ([479e967](https://github.com/vibeunion/supacloud/commit/479e96719209f7aed26c44663d78e1442a7097f0))
+
 ## [0.29.4](https://github.com/vibeunion/supacloud/compare/supacloud-lite-v0.29.3...supacloud-lite-v0.29.4) (2026-10-16)
 
 

package/dist/cli.js

@@ -8,7 +8,7 @@ import { dirname as dirname8, join as join10, resolve as resolve6 } from "path";
 // package.json
 var package_default = {
   name: "@supacloud/lite",
-  version: "0.29.4",
+  version: "0.30.0",
   description: "Bun-native, single-project Supabase-compatible backend powered by PGlite or native PostgreSQL",
   type: "module",
   license: "Apache-2.0",
@@ -67,16 +67,16 @@ var package_default = {
     "@electric-sql/pglite-pgmq": "0.0.8",
     "@electric-sql/pglite-pgvector": "0.0.11",
     "@electric-sql/pglite-postgis": "0.2.10",
-    "@supacloud/db": "^0.17.0",
+    "@supacloud/db": "0.18.1",
     "exact-mirror": "1.2.6",
     tar: "^7.5.22",
     typebox: "1.3.37"
   },
   devDependencies: {
-    "@supacloud/app": "file:../app",
-    "@supacloud/contracts": "file:../contracts",
-    "@supacloud/compiler": "file:../compiler",
-    "@supacloud/elysia": "file:../elysia",
+    "@supacloud/app": "0.27.2",
+    "@supacloud/contracts": "0.11.2",
+    "@supacloud/compiler": "0.46.7",
+    "@supacloud/elysia": "0.33.2",
     "@supabase/supabase-js": "^2.117.3",
     "@types/bun": "^1.4.3",
     effect: "4.0.5",
@@ -85,13 +85,13 @@ var package_default = {
     typescript: "^7.0.2"
   },
   overrides: {
-    "@supacloud/db": "^0.17.0",
-    "@supacloud/app": "file:../app",
-    "@supacloud/compiler": "file:../compiler",
-    "@supacloud/elysia": "file:../elysia",
-    "@supacloud/contracts": "file:../contracts",
-    "@supacloud/commands": "file:../commands",
-    "@supacloud/delivery": "file:../delivery",
+    "@supacloud/db": "0.18.1",
+    "@supacloud/app": "0.27.2",
+    "@supacloud/compiler": "0.46.7",
+    "@supacloud/elysia": "0.33.2",
+    "@supacloud/contracts": "0.11.2",
+    "@supacloud/commands": "0.9.4",
+    "@supacloud/delivery": "0.19.1",
     "@graphql-tools/utils": "^12.0.4"
   },
   engines: {
@@ -242,6 +242,13 @@ function isAllowedRedirect(requested, siteUrl, allowList = []) {
 }
 
 // src/runtime/auth/oauth.ts
+class OAuthAccountIneligibleError extends Error {
+  code;
+  constructor(code) {
+    super(code);
+    this.code = code;
+  }
+}
 var PRESETS = {
   google: {
     authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
@@ -364,14 +371,30 @@ class OAuthService {
       const msg = encodeURIComponent(e instanceof Error ? e.message : "oauth_error");
       return redirect(`${flow.redirect_to}#error=server_error&error_description=${msg}`);
     }
-    const userId = await this.upsertUser(provider.name, profile);
+    let userId;
+    try {
+      userId = await this.upsertUser(provider.name, profile);
+    } catch (e) {
+      if (e instanceof OAuthAccountIneligibleError) {
+        return redirect(`${flow.redirect_to}#error=access_denied&error_code=${e.code}`);
+      }
+      throw e;
+    }
     if (flow.code_challenge) {
       const authCode = randomToken(24);
       await this.db.query(`insert into auth.flow_state (provider, provider_state, redirect_to, code_challenge, code_challenge_method, auth_code, user_id, expires_at)
          values ($1, $2, $3, $4, $5, $6, $7, now() + interval '5 minutes')`, [flow.provider, randomToken(16), flow.redirect_to, flow.code_challenge, flow.code_challenge_method, authCode, userId]);
       return redirect(`${flow.redirect_to}?code=${authCode}`);
     }
-    const session = await createSession(userId);
+    let session;
+    try {
+      session = await createSession(userId);
+    } catch (e) {
+      if (e instanceof OAuthAccountIneligibleError) {
+        return redirect(`${flow.redirect_to}#error=access_denied&error_code=${e.code}`);
+      }
+      throw e;
+    }
     const hash = `#access_token=${session.access_token}&refresh_token=${session.refresh_token}&expires_in=${session.expires_in}&token_type=bearer&provider_token=`;
     return redirect(`${flow.redirect_to}${hash}`);
   }
@@ -422,31 +445,37 @@ class OAuthService {
     return profile;
   }
   async upsertUser(provider, profile) {
-    const existing = await this.db.query(`select user_id from auth.identities where provider = $1 and provider_id = $2`, [provider, profile.id]);
+    return this.db.transaction((query) => this.upsertUserInTransaction(query, provider, profile));
+  }
+  async upsertUserInTransaction(query, provider, profile) {
+    const existing = await query(`select user_id from auth.identities where provider = $1 and provider_id = $2`, [provider, profile.id]);
     if (existing.rows[0]) {
-      await this.db.query(`update auth.identities set last_sign_in_at = now(), identity_data = $3 where provider = $1 and provider_id = $2`, [
+      await this.assertUserEligible(query, existing.rows[0].user_id);
+      await query(`update auth.identities set last_sign_in_at = now(), identity_data = $3 where provider = $1 and provider_id = $2`, [
         provider,
         profile.id,
         JSON.stringify({ sub: profile.id, email: profile.email, ...profile.metadata })
       ]);
-      await this.db.query(`update auth.users set last_sign_in_at = now() where id = $1`, [existing.rows[0].user_id]);
+      await query(`update auth.users set last_sign_in_at = now() where id = $1`, [existing.rows[0].user_id]);
       return existing.rows[0].user_id;
     }
     let userId;
     const email = profile.email?.toLowerCase() ?? null;
     const verified = !!profile.email && profile.emailVerified === true;
     if (email && verified) {
-      const byEmail = await this.db.query(`select id from auth.users where email = $1`, [email]);
+      const byEmail = await query(`select id from auth.users where email = $1`, [email]);
       userId = byEmail.rows[0]?.id;
+      if (userId)
+        await this.assertUserEligible(query, userId);
     }
     if (!userId) {
       let userEmail = verified ? email : null;
       if (userEmail) {
-        const taken = await this.db.query(`select 1 from auth.users where email = $1`, [userEmail]);
+        const taken = await query(`select 1 from auth.users where email = $1`, [userEmail]);
         if (taken.rows.length > 0)
           userEmail = null;
       }
-      const created = await this.db.query(`insert into auth.users (aud, role, email, email_confirmed_at, last_sign_in_at, raw_app_meta_data, raw_user_meta_data)
+      const created = await query(`insert into auth.users (aud, role, email, email_confirmed_at, last_sign_in_at, raw_app_meta_data, raw_user_meta_data)
          values ('authenticated','authenticated',$1, $2, now(),
                  $3::jsonb, $4::jsonb) returning id`, [
         userEmail,
@@ -459,12 +488,22 @@ class OAuthService {
         throw new Error("OAuth user creation returned no row");
       userId = user.id;
     }
-    await this.db.query(`insert into auth.identities (user_id, provider, provider_id, identity_data)
+    await query(`insert into auth.identities (user_id, provider, provider_id, identity_data)
        values ($1, $2, $3, $4::jsonb)`, [userId, provider, profile.id, JSON.stringify({ sub: profile.id, email: profile.email, ...profile.metadata })]);
     if (!userId)
       throw new Error("OAuth identity has no user ID");
     return userId;
   }
+  async assertUserEligible(query, userId) {
+    const users = await query(`select deleted_at is not null as is_deleted,
+              coalesce(banned_until > now(), false) as is_banned
+       from auth.users where id = $1 for update`, [userId]);
+    const user = users.rows[0];
+    if (!user || user.is_deleted)
+      throw new OAuthAccountIneligibleError("user_not_found");
+    if (user.is_banned)
+      throw new OAuthAccountIneligibleError("user_banned");
+  }
 }
 function redirect(location) {
   return new Response(null, { status: 303, headers: { location } });
@@ -1350,6 +1389,8 @@ class AuthHandler {
         return await this.admin(req, ctx, path, method);
       return authError(404, "not_found", `unknown auth endpoint: ${path}`);
     } catch (e) {
+      if (e instanceof OAuthAccountIneligibleError)
+        return authError(400, e.code, e.message);
       const msg = e instanceof Error ? e.message : String(e);
       return authError(500, "unexpected_failure", msg);
     }
@@ -1413,8 +1454,12 @@ class AuthHandler {
     const body = await req.json().catch(() => ({}));
     if (grantType === "password") {
       const email = (body.email ?? "").toLowerCase().trim();
-      const res = await this.db.query(`select * from auth.users where email = $1`, [email]);
+      const res = await this.db.query(`select *, coalesce(banned_until > now(), false) as is_banned
+         from auth.users where email = $1 and deleted_at is null`, [email]);
       const user = res.rows[0];
+      if (user?.encrypted_password && user.is_banned) {
+        return authError(400, "user_banned", "User is banned");
+      }
       if (!user || !user.encrypted_password || !await verifyPassword(body.password ?? "", user.encrypted_password)) {
         await this.audit("login_failed", { actorEmail: email, traits: { grant_type: "password" } });
         return authError(400, "invalid_credentials", "Invalid login credentials");
@@ -1440,8 +1485,7 @@ class AuthHandler {
       const userId = await this.oauth.exchangePkce(authCode, verifier);
       if (!userId)
         return authError(403, "flow_state_not_found", "invalid or expired auth code");
-      const ures = await this.db.query(`select * from auth.users where id = $1`, [userId]);
-      return json(200, await this.sessionForOAuth(ures.rows[0]));
+      return json(200, await this.sessionForOAuth(userId));
     }
     return authError(400, "invalid_grant", `unsupported grant_type: ${grantType}`);
   }
@@ -1736,7 +1780,10 @@ Or sign in with this link: ${link}`
       tokenTypes: `{${types.join(",")}}`,
       email: email?.toLowerCase().trim() ?? null
     };
-    return this.db.transaction((query) => this.claimEmailToken(query, redemption));
+    return this.db.transaction(async (query) => {
+      const user = await this.claimEmailToken(query, redemption);
+      return user ? this.sessionFor(user, undefined, undefined, query) : null;
+    });
   }
   async claimEmailToken(query, redemption) {
     const candidate = await this.findEmailTokenCandidate(query, redemption);
@@ -1748,7 +1795,10 @@ Or sign in with this link: ${link}`
     return claimedToken ? this.confirmEmailTokenUser(query, claimedToken) : null;
   }
   async lockAndDeleteEmailToken(query, candidate, redemption) {
-    await query(`select id from auth.users where id = $1 for update`, [candidate.user_id]);
+    const eligible = await query(`select id from auth.users where id = $1 and deleted_at is null
+         and (banned_until is null or banned_until <= now()) for update`, [candidate.user_id]);
+    if (eligible.rows.length === 0)
+      return null;
     const claimedTokens = await query(`delete from auth.one_time_tokens
        where id = $1 and token = $2 and token_type = any($3::text[])
          and expires_at > now() and attempts < $4
@@ -1801,10 +1851,10 @@ Or sign in with this link: ${link}`
       return json(200, session);
     }
     const types = body.type === "recovery" ? ["recovery"] : body.type === "magiclink" ? ["magiclink"] : ["otp", "magiclink"];
-    const user = await this.redeem(token, types, body.email);
-    if (!user)
+    const session = await this.redeem(token, types, body.email);
+    if (!session)
       return authError(403, "otp_expired", "Token has expired or is invalid");
-    return json(200, await this.sessionFor(user));
+    return json(200, session);
   }
   async redeemPhoneOtp(phone, code) {
     const tokenDigest = `hmac-sha256:v1:${await keyedDigest(this.config.jwtSecret, "supacloud-lite:phone-otp:v1", `${phone}\x00${code}`)}`;
@@ -1845,11 +1895,10 @@ Or sign in with this link: ${link}`
     const token = url.searchParams.get("token") ?? "";
     const type = url.searchParams.get("type") ?? "magiclink";
     const redirectTo = resolveRedirect(url.searchParams.get("redirect_to"), this.config.siteUrl, this.config.uriAllowList, this.config.enforceRedirectAllowList);
-    const user = await this.redeem(token, [type]);
-    if (!user) {
+    const session = await this.redeem(token, [type]);
+    if (!session) {
       return new Response(null, { status: 303, headers: { location: `${redirectTo}#error=access_denied&error_code=otp_expired` } });
     }
-    const session = await this.sessionFor(user);
     const hash = `#access_token=${session.access_token}&refresh_token=${session.refresh_token}&expires_in=${session.expires_in}&token_type=bearer&type=${type}`;
     return new Response(null, { status: 303, headers: { location: `${redirectTo}${hash}` } });
   }
@@ -2150,6 +2199,11 @@ Or sign in with this link: ${link}`
       return authError(422, "mfa_verification_failed", "Invalid TOTP code entered");
     }
     const session = await this.db.transaction(async (query) => {
+      const currentUsers = await query(`select * from auth.users where id = $1 and deleted_at is null
+           and (banned_until is null or banned_until <= now()) for update`, [user.id]);
+      const currentUser = currentUsers.rows[0];
+      if (!currentUser)
+        return null;
       const claimed = await query(`update auth.mfa_challenges set verified_at = now()
          where id = $1 and factor_id = $2 and verified_at is null and expires_at >= now()
          returning id`, [challenge.id, factorId]);
@@ -2158,7 +2212,7 @@ Or sign in with this link: ${link}`
       if (factor.status !== "verified") {
         await query(`update auth.mfa_factors set status = 'verified', updated_at = now() where id = $1`, [factorId]);
       }
-      return this.sessionFor(user, undefined, {
+      return this.sessionFor(currentUser, undefined, {
         aal: "aal2",
         amr: [
           { method: "password", timestamp: Math.floor(Date.now() / 1000) },
@@ -2219,6 +2273,18 @@ Or sign in with this link: ${link}`
   }
   async rotateRefreshToken(token) {
     return this.db.transaction(async (query) => {
+      const availableToken = await this.findAvailableRefreshToken(query, token);
+      if (!availableToken)
+        return authError(400, "refresh_token_not_found", "Invalid Refresh Token: Refresh Token Not Found");
+      const userResult = await query(`select *, coalesce(banned_until > now(), false) as is_banned
+         from auth.users where id = $1 for update`, [availableToken.user_id]);
+      const user = userResult.rows[0];
+      if (!user || user.deleted_at !== null) {
+        return authError(400, "refresh_token_not_found", "Invalid Refresh Token: Refresh Token Not Found");
+      }
+      if (user.is_banned) {
+        return authError(400, "user_banned", "Invalid Refresh Token: User Banned");
+      }
       const claimedToken = await this.claimRefreshToken(query, token);
       if (!claimedToken)
         return authError(400, "refresh_token_not_found", "Invalid Refresh Token: Refresh Token Not Found");
@@ -2226,14 +2292,19 @@ Or sign in with this link: ${link}`
       const expiryError = this.refreshExpiryError(claimedToken, sessionStartedAt);
       if (expiryError)
         return expiryError;
-      const userResult = await query(`select * from auth.users where id = $1`, [claimedToken.user_id]);
-      const session = await this.sessionFor(userResult.rows[0], token, {
+      const session = await this.sessionFor(user, token, {
         sessionId: claimedToken.session_id ?? undefined,
         sessionStartedAt: sessionStartedAt === null ? undefined : Math.floor(sessionStartedAt / 1000)
       }, query);
       return json(200, session);
     });
   }
+  async findAvailableRefreshToken(query, token) {
+    const available = await query(`select user_id, session_id, created_at
+       from auth.refresh_tokens
+       where token = $1 and revoked is not true`, [token]);
+    return available.rows[0];
+  }
   async claimRefreshToken(query, token) {
     const claimed = await query(`update auth.refresh_tokens set revoked = true, updated_at = now()
        where token = $1 and revoked is not true
@@ -2261,7 +2332,8 @@ Or sign in with this link: ${link}`
     const claims = await this.claimsFromBearer(req);
     if (!claims?.sub)
       return null;
-    const res = await this.db.query(`select * from auth.users where id = $1`, [claims.sub]);
+    const res = await this.db.query(`select * from auth.users where id = $1 and deleted_at is null
+         and (banned_until is null or banned_until <= now())`, [claims.sub]);
     return res.rows[0] ?? null;
   }
   async claimsFromBearer(req) {
@@ -2290,14 +2362,22 @@ Or sign in with this link: ${link}`
       is_anonymous: u.is_anonymous ?? false
     };
   }
-  sessionForOAuth(user) {
-    return this.sessionFor(user, undefined, {
-      amr: [{ method: "oauth", timestamp: Math.floor(Date.now() / 1000) }]
+  sessionForOAuth(userId) {
+    return this.db.transaction(async (query) => {
+      const res = await query(`select *, coalesce(banned_until > now(), false) as is_banned
+         from auth.users where id = $1 for update`, [userId]);
+      const user = res.rows[0];
+      if (!user || user.deleted_at !== null)
+        throw new OAuthAccountIneligibleError("user_not_found");
+      if (user.is_banned)
+        throw new OAuthAccountIneligibleError("user_banned");
+      return this.sessionFor(user, undefined, {
+        amr: [{ method: "oauth", timestamp: Math.floor(Date.now() / 1000) }]
+      }, query);
     });
   }
   async oauthSessionTokensFor(userId) {
-    const res = await this.db.query(`select * from auth.users where id = $1`, [userId]);
-    const session = await this.sessionForOAuth(res.rows[0]);
+    const session = await this.sessionForOAuth(userId);
     return { access_token: session.access_token, refresh_token: session.refresh_token, expires_in: session.expires_in };
   }
   async sessionFor(user, parentToken, opts, query = (sql, params) => this.db.query(sql, params)) {
@@ -8974,8 +9054,18 @@ var IMAGE_FORMAT_CONTENT_TYPES = {
   gif: "image/gif"
 };
 var MAX_TRANSFORM_DIMENSION = 2500;
-var MAX_TRANSFORM_BYTES = 25 * 1024 * 1024;
+var MAX_TRANSFORM_BYTES = 500 * 1024 * 1024;
 var MAX_TRANSFORM_PIXELS = 50000000;
+function resolveImageTransformLimits(options = {}) {
+  const maxInputBytes = options.maxInputBytes === undefined ? MAX_TRANSFORM_BYTES : options.maxInputBytes;
+  const maxOutputBytes = options.maxOutputBytes === undefined ? MAX_TRANSFORM_BYTES : options.maxOutputBytes;
+  for (const [name, value] of Object.entries({ maxInputBytes, maxOutputBytes })) {
+    if (!Number.isSafeInteger(value) || value < 1 || value > MAX_TRANSFORM_BYTES) {
+      throw new Error(`Invalid image transformation ${name}: expected 1..${MAX_TRANSFORM_BYTES} bytes`);
+    }
+  }
+  return { maxInputBytes, maxOutputBytes };
+}
 function invalid(message) {
   return { ok: false, status: 400, error: "InvalidTransformation", message };
 }
@@ -9033,7 +9123,16 @@ function parseImageTransform(query) {
   if (quality !== undefined && format === "png") {
     return invalid("quality is supported only for jpeg and webp output");
   }
-  return { ok: true, value: { width, height, resize, quality, format } };
+  return {
+    ok: true,
+    value: {
+      resize,
+      format,
+      ...width === undefined ? {} : { width },
+      ...height === undefined ? {} : { height },
+      ...quality === undefined ? {} : { quality }
+    }
+  };
 }
 function imageTransformToSearchParams(options) {
   const query = new URLSearchParams;
@@ -9107,15 +9206,16 @@ function applyResize(image, metadata, options) {
   const proportionalWidth = Math.max(1, Math.round(metadata.width * height / metadata.height));
   image.resize(proportionalWidth);
 }
-async function transformImage(source, options, knownSourceSize) {
+async function transformImage(source, options, knownSourceSize, configuredLimits = {}) {
+  const limits = resolveImageTransformLimits(configuredLimits);
   const actualSourceSize = source instanceof Uint8Array ? source.byteLength : await Promise.resolve(source.size);
   const sourceSize = Math.max(knownSourceSize ?? 0, actualSourceSize);
-  if (sourceSize > MAX_TRANSFORM_BYTES) {
+  if (sourceSize > limits.maxInputBytes) {
     return {
       ok: false,
       status: 413,
       error: "ImageTooLarge",
-      message: "The source image exceeds the 25MB transformation limit"
+      message: `The source image exceeds the transformation limit (${limits.maxInputBytes} bytes)`
     };
   }
   const image = new Bun.Image(source, { maxPixels: MAX_TRANSFORM_PIXELS });
@@ -9148,12 +9248,12 @@ async function transformImage(source, options, knownSourceSize) {
   }
   try {
     const bytes = await image.bytes();
-    if (bytes.byteLength > MAX_TRANSFORM_BYTES) {
+    if (bytes.byteLength > limits.maxOutputBytes) {
       return {
         ok: false,
         status: 413,
         error: "ImageTooLarge",
-        message: "The transformed image exceeds the 25MB transformation limit"
+        message: `The transformed image exceeds the transformation limit (${limits.maxOutputBytes} bytes)`
       };
     }
     return { ok: true, bytes, contentType };
@@ -9356,10 +9456,12 @@ class StorageHandler {
   tusUploads = new Map;
   mutationTail = Promise.resolve();
   imageTransforms = new ImageTransformCache;
+  transformLimits;
   constructor(db, driver, config) {
     this.db = db;
     this.driver = driver;
     this.config = config;
+    this.transformLimits = resolveImageTransformLimits(config.imageTransformLimits);
   }
   async ensureBuckets(buckets) {
     for (const b of buckets) {
@@ -9635,7 +9737,7 @@ class StorageHandler {
         const source = await this.readObjectSource(row);
         if (source === null)
           throw new StorageObjectMissingError;
-        return transformImage(source, parsed.value, objectSize(row));
+        return transformImage(source, parsed.value, objectSize(row), this.transformLimits);
       });
     } catch (error) {
       if (error instanceof StorageObjectMissingError) {
@@ -11731,6 +11833,7 @@ ${msg.text}` : `[mail] to=${msg.to} subject="${msg.subject}"`));
   const storage = new StorageHandler(db, config.storageDriver ?? new MemoryStorageDriver, {
     jwtSecret,
     defaultFileSizeLimit: config.storageFileSizeLimit,
+    imageTransformLimits: config.storageImageTransformLimits,
     log
   });
   if (config.buckets?.length) {
@@ -13270,8 +13373,22 @@ import { readFile as readFile2, stat } from "fs/promises";
 import { dirname as dirname3, resolve as resolve3 } from "path";
 import { pathToFileURL } from "url";
 
-// node_modules/@supacloud/db/dist/index.js
+// ../db/dist/index.js
 import { createHash as createHash3 } from "crypto";
+
+// ../contracts/dist/index.mjs
+var commandErrorBrand = Symbol.for("@supacloud/contracts/CommandError/v1");
+var commandErrorCodes = new Set([
+  "COMMAND_INPUT_INVALID",
+  "COMMAND_REJECTED",
+  "COMMAND_UNAVAILABLE",
+  "COMMAND_IDEMPOTENCY_CONFLICT",
+  "COMMAND_RECEIPT_INVALID",
+  "COMMAND_OUTCOME_UNKNOWN",
+  "COMMAND_INPUT_EXPIRED"
+]);
+
+// ../db/dist/index.js
 var TABLES_SQL = `
 SELECT n.nspname AS schema,
        c.relname AS name,
@@ -14680,6 +14797,19 @@ function readStorage(root) {
   const limit = getByteSize(storage, "file_size_limit");
   if (limit !== undefined)
     out.fileSizeLimit = limit;
+  const image = tableAt(root, "storage.image_transformation");
+  if (image) {
+    const limits = {};
+    for (const [key, field] of [["max_input_bytes", "maxInputBytes"], ["max_output_bytes", "maxOutputBytes"]]) {
+      if (!image.values.has(key))
+        continue;
+      const value = getByteSize(image, key);
+      if (value === undefined)
+        throw new Error(`Invalid image transformation ${key}`);
+      limits[field] = value;
+    }
+    out.imageTransformLimits = resolveImageTransformLimits(limits);
+  }
   const buckets = tableAt(root, "storage.buckets");
   if (buckets && buckets.children.size > 0) {
     out.buckets = [...buckets.children].map(([id, t]) => ({
@@ -15517,6 +15647,7 @@ async function createProjectBackend(options = {}) {
       dbSchemas: config.api.schemas,
       maxRows: config.api.maxRows,
       storageFileSizeLimit: config.storage.fileSizeLimit,
+      storageImageTransformLimits: config.storage.imageTransformLimits,
       buckets: config.storage.buckets,
       migrations: options.applyMigrations === false ? [] : project.migrations,
       seedSql: options.applyMigrations === false || options.includeSeed === false ? undefined : project.seedSql,